Log Forgery Vulnerability in Morgan Middleware by Express.js

CVE-2026-5078

What is CVE-2026-5078?

The Morgan middleware is susceptible to a log forgery vulnerability due to improper handling of control characters in the :remote-user token. When an attacker sends a specially crafted Authorization Basic header containing CR or LF bytes, it can lead to forged log entries. This compromises the integrity of access logs, allowing downstream log consumers to be misled. The vulnerability affects versions 1.2.0 to 1.10.1 and can be mitigated by upgrading to version 1.11.0 or by using a custom log format that omits the :remote-user reference.

References