CVE-2026-15603
Awaiting Analysis Awaiting Analysis - Queue

Unicode Line Separator Log Forging in Morgan HTTP Logger

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: openjs

Description
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-15603
EUVD
EUVD-2026-67720

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the morgan HTTP request logger middleware for Node.js. In versions before 1.12.0, the log token escaping function did not properly handle certain Unicode line separator characters (U+0085, U+2028, U+2029). An attacker can inject these characters into log tokens, such as a Basic auth username, causing downstream log processors to split a single log entry into multiple records.

Detection Guidance

This vulnerability can be detected by checking the version of the morgan library in use. Run 'npm list morgan' or check your package.json file to verify if the version is prior to 1.12.0. Additionally, inspect logs for unusual line breaks or multiple records from a single request.

Impact Analysis

This could allow an attacker to forge log entries, making logs appear as if multiple requests occurred when only one happened. This may lead to confusion in log analysis, security monitoring, and incident response. The impact is limited to log integrity rather than direct system compromise.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by compromising log integrity. Attackers can forge log entries by injecting Unicode line separators, splitting single logs into multiple records. This may lead to inaccurate audit trails, violating GDPR's accountability principle and HIPAA's integrity requirements for protected health information logs.

Mitigation Strategies

Immediately upgrade the morgan library to version 1.12.0 or later using 'npm update morgan' or by updating the package.json file and reinstalling dependencies. Ensure all dependent applications are restarted to apply the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart