Log Forging Vulnerability in morgan Middleware for Node.js by Express.js

CVE-2026-15603

What is CVE-2026-15603?

The morgan middleware for Node.js contains a log forging vulnerability that arises from its inability to effectively escape Unicode line separator characters in log token values. This flaw allows an unauthenticated remote client to manipulate log entries by embedding these characters into an attacker-controlled log token. Consequently, this results in the potential for log entries to be incorrectly split into multiple records during processing, facilitating misleading log information. The issue is a continuation of the previously reported incomplete fix for ASCII control characters. The vulnerability is addressed in morgan version 1.12.0, which broadens the range of escaped characters to include the problematic Unicode line separators.

References