CVE-2026-5078: Morgan Middleware Log Injection via Basic Auth Username

Technical summary

CVE-2026-5078 is an improper neutralization of input during log generation vulnerability (CWE-117) in morgan versions 1.2.0 through 1.10.1. The :remote-user token, which extracts the Basic authentication username from the Authorization header, is written directly to the log output stream without sanitization of control characters (CR/LF). An unauthenticated attacker can inject CRLF sequences via the Authorization header to break the one-request-per-line contract of access logs and forge arbitrary log entries. All default log formats (combined, common, default, short) are affected, along with any custom format referencing :remote-user. Morgan 1.11.0 remediates this by neutralizing control characters in the :remote-user token output.

Business impact

Log injection vulnerabilities undermine the integrity of access logs, a critical control for security investigations, incident response, and compliance auditing (GDPR, PCI-DSS, SOC 2). Forged log entries can mask attacker activity, create false evidence of successful authentication, or pollute logs to evade detection systems. Organizations relying on log aggregation and SIEM tools may be misled by injected records, delaying incident detection and complicating forensic analysis. This is particularly concerning for applications that use logs as audit trails for regulated workloads.

Affected systems

Morgan 1.2.0 through 1.10.1 are vulnerable. The scope is limited to applications using morgan as their HTTP logging middleware and exposing its logging to downstream consumers. Node.js web applications using Express, Koa, or other frameworks that integrate morgan are at risk if they rely on :remote-user logging. Applications using custom log formats that do not reference :remote-user are unaffected.

Exploitability

The vulnerability requires network access but no authentication or user interaction. An attacker can exploit it by sending a simple HTTP request with a crafted Authorization header containing embedded control characters—no specialized tools or techniques are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the low barrier to entry. However, practical impact depends on how strictly downstream log consumers parse log records; some log aggregation systems may normalize or filter control characters, reducing the exploit's effectiveness in those contexts.

Remediation

Upgrade morgan to version 1.11.0 or later, which neutralizes control characters in the :remote-user token. For organizations unable to upgrade immediately, a temporary workaround is to modify the log format string to exclude :remote-user (e.g., use a custom format without that token). Additionally, implement log parsing and validation controls in downstream SIEM or log aggregation systems to reject or sanitize log records with unexpected line breaks.

Patch guidance

Apply morgan 1.11.0 as soon as feasible. Verify the upgrade via npm (npm install [email protected] or update package.json and reinstall dependencies). Test the patched version in a staging environment to ensure logging continues to function correctly and that no custom integrations depend on the prior (unfiltered) behavior of :remote-user. No breaking changes are expected; sanitization of control characters is a security hardening measure.

Detection guidance

Monitor application logs for Authorization headers containing %0D (CR) or %0A (LF) sequences in HTTP request logs or WAF/proxy logs. Look for log entries where :remote-user field spans multiple lines or contains unexpected line breaks. If log parsing fails or records are malformed in ways consistent with CRLF injection, investigate recent traffic patterns. Enable verbose logging on morgan or use HTTP traffic inspection to identify requests with crafted usernames. Endpoint detection and response (EDR) tools or log analysis rules can flag requests with embedded control characters in Basic auth headers.

Why prioritize this

Although CVSS 5.3 (MEDIUM) may seem low, log integrity is foundational to security operations. This vulnerability is rated MEDIUM because it enables integrity violations (log forgery) with no confidentiality or availability impact and requires the attacker to influence log contents that are then consumed downstream. However, organizations with strong log-based incident detection, compliance auditing, or forensic reliance should prioritize this patch to prevent tampering with audit trails. The lack of KEV designation suggests limited active exploitation, reducing urgency but not justifying delay.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) is assigned because the attack has network accessibility and low complexity (AV:N/AC:L) but impacts only integrity (I:L) with no confidentiality or availability loss (C:N/A:N). No privileges or user interaction are required (PR:N/UI:N). The scope is unchanged (S:U). Log injection is recognized as a legitimate integrity threat, warranting a score in the MEDIUM range rather than LOW. Organizations with heightened audit and compliance requirements may treat this as higher priority despite the base score.

Frequently asked questions