---
id: CVE-2026-5078
aliases:
  - GHSA-4vj7-5mj6-jm8m
title: >-
  morgan vulnerable to Log Forging via unneutralized control characters in
  :remote-user
summary: >-
  morgan vulnerable to Log Forging via unneutralized control characters in
  :remote-user
severity: medium
cvss: 5.3
cwe:
  - CWE-117
vendor: morgan
product: morgan
ecosystem: npm
affected:
  - 'morgan >= 1.2.0, <= 1.10.1'
patched:
  - morgan 1.11.0
published: '2026-07-10'
updated: '2026-07-10'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4vj7-5mj6-jm8m'
references:
  - url: >-
      https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5078'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/advisories/GHSA-4vj7-5mj6-jm8m'
tags:
  - ghsa
  - npm
epss: 0.00415
epssPercentile: 0.33122
ingestedAt: '2026-07-10T15:05:05.664Z'
---

## Overview

### Impact

Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs.

The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`.

### Patches

Users should upgrade to version 1.11.0.

### Workarounds

Use a custom format string that does not include `:remote-user`.

## Affected packages

- `morgan >= 1.2.0, <= 1.10.1`

## Remediation

Upgrade to a patched release:

- `morgan 1.11.0`