CVE-2026-15603Medium· 5.3▾ Sunlitmorgan vulnerable to Log Forging via unescaped Unicode line separators
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 (NEL), U+2028 (LINE SEPARATOR), or U+2029 (PARAGRAPH SEPARATOR). These code points are reachable through several tokens, including the request URL (:url), request headers such as :user-agent and :referrer, arbitrary :req[header] values, and the Basic auth username (:remote-user). NEL is valid obs-text in HTTP header values, so an attacker can place it in an ordinary request header.
When such a value is logged, the raw code points survive into the emitted access-log record, and downstream ECMAScript-aware or Unicode-aware log processing splits the single physical record into multiple logical records. This allows an attacker to forge log entries. The built-in combined, common, default, and short formats are affected, as well as any custom format. This is an incomplete fix of CVE-2026-5078.
Users should upgrade to version 1.12.0.
None. The affected values include the request URL and request headers, which are core to access logging, so there is no practical format-based mitigation. Upgrade to 1.12.0.
morgan < 1.12.0Upgrade to a patched release:
morgan 1.12.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5078Medium· 5.3morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
CVE-2026-87859Medium· 5.3morgan is an HTTP request logger middleware for Node.js
CVE-2026-54511High· 8.6LogTape is an unobtrusive logging library
CVE-2025-11537Medium· 5.0Keycloak logs sensitive headers
CVE-2026-15661Medium· 5.3IBM Concert Software Improper Output Neutralization for Logs
CVE-2026-63442High· 8.1OPNsense is a FreeBSD based firewall and routing platform