Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-02 | 1 | Patch1 |
| 2026-06-03 | 1 | General1 |
| 2026-09-09 | 1 | Disclosure1 |
🚨 Moderate-severity security fix in morgan@1.11.0 just released! Patches CVE-2026-5078 — morgan vulnerable to Log Forging via unneutralized control characters in :remote-user https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m
Post summary
The message announces the release of a security fix for CVE-2026-5078, detailing the vulnerability type and providing a link to the official patch advisory.
🟠 Morgan (Nodejs), Log Injection Incomplete Fix, #CVE-2026-5078 (Medium) -DC-Sep2026-2275 https://dailycve.com/morgan-nodejs-log-injection-incomplete-fix-cve-2026-5078-medium-dc-sep2026-2275/
Post summary
The tweet announces the existence of CVE-2026-5078, a Log Injection vulnerability in Morgan with a Medium severity and notes an incomplete fix, but it does not provide PoC, exploit details, or evidence of active exploitation.
CVE-2026-5078 Log Injection Vulnerability in Morgan Logging Middleware 1.2.0-1.10.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5078
Post summary
The text notes the existence of CVE‑2026‑5078—a log injection issue in Morgan Logging Middleware—but offers only the vulnerability name and affected versions, with no proof‑of‑concept, exploit, patch, or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | morgan_project | morgan | - | node.js | - |