CVE-2026-5078
Log Injection via Basic Auth Username in Morgan Logging Middleware
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: openjs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| expressjs | morgan | From 1.2.0 (inc) to 1.10.1 (inc) |
| expressjs | morgan | 1.11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-117 | The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the morgan logging middleware for Node.js, specifically in the :remote-user token. This token extracts the Basic authentication username from the Authorization request header and writes it to the log stream without neutralizing control characters like carriage return (CR) or line feed (LF).
An unauthenticated attacker can exploit this by sending a crafted Authorization Basic header containing CR or LF characters, which allows them to inject forged log lines. This breaks the one-request-per-line structure of access logs and enables log forgery against downstream log consumers.
The vulnerability affects morgan versions 1.2.0 through 1.10.1 and impacts the built-in combined, common, default, and short log formats, as well as any custom format that references :remote-user.
The issue has been fixed in morgan version 1.11.0 by neutralizing control characters in the :remote-user token output. A temporary workaround is to use a custom log format string that does not include :remote-user.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to inject forged log entries into your access logs by exploiting the improper handling of control characters in the :remote-user token.
Such log forgery can disrupt the integrity and reliability of your logs, making it difficult to accurately track and audit user activity or system events.
It may also enable attackers to hide their malicious activities or create misleading log entries, which can hinder incident response and forensic investigations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring your HTTP access logs for suspicious or malformed entries that indicate log forging attempts, such as unexpected line breaks or injected log lines caused by control characters in the Authorization Basic header.
You can also inspect network traffic or captured HTTP requests to identify Authorization headers containing carriage return (CR) or line feed (LF) characters.
Suggested commands include using tools like grep or awk to search logs or captured traffic for suspicious patterns.
- grep -P '\r|\n' access.log # Search for carriage return or line feed characters in logs
- tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep 'Authorization: Basic' # Capture HTTP traffic and filter for Authorization headers
- Use a script or tool to parse logs and detect multiple log lines injected by a single request, indicating log forging.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps are to upgrade the morgan package to version 1.11.0 or later, where the vulnerability is patched by neutralizing control characters in the :remote-user token.
If upgrading is not immediately possible, a temporary workaround is to use a custom log format string that does not include the :remote-user token, thereby avoiding the vulnerable code path.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to inject forged log lines by exploiting improper neutralization of control characters in the :remote-user token of the morgan logging middleware. Such log forging can compromise the integrity and reliability of access logs.
Since accurate and tamper-proof logging is critical for compliance with standards like GDPR and HIPAA, which require secure audit trails and protection of sensitive information, this vulnerability could negatively impact compliance by enabling log manipulation and potentially obscuring unauthorized access or other security events.
Mitigating this vulnerability by upgrading to morgan 1.11.0 or avoiding the :remote-user token in log formats is important to maintain compliance with these regulations.