A critical vulnerability has been identified within the logging middleware package involving improper neutralization of control characters. This flaw, assigned a CVSS v3 score of 5.3, allows for log forging when processing the remote-user token from authorization headers. Attackers can leverage this by sending crafted requests that insert newline characters into the log stream, thereby disrupting log integrity and enabling the falsification of system events. The issue impacts multiple standard logging formats, posing a risk to log analysis workflows and security monitoring capabilities that rely on structured, per-request log entries.
CVE-2026-5078: This vulnerability stems from the failure of the package to sanitize the :remote-user token before writing it to the log output. By embedding carriage return or line feed characters within the Authorization: Basic header, an external actor can manipulate the output file structure. This technique corrupts the one-request-per-line logging convention, potentially masking malicious activities or injecting deceptive entries into critical system records. The vulnerability affects standard configurations, including common and default logging formats, presenting a significant threat to audit trail reliability across any system utilizing this logging component.[/subscribe_to_unlock_form]
A critical vulnerability has been identified within the logging middleware package involving improper neutralization of control characters. This flaw, assigned a CVSS v3 score of 5.3, allows for log forging when processing the remote-user token from authorization headers. Attackers can leverage this by sending crafted requests that insert newline characters into the log stream, thereby disrupting log integrity and enabling the falsification of system events. The issue impacts multiple standard logging formats, posing a risk to log analysis workflows and security monitoring capabilities that rely on structured, per-request log entries.
CVE-2026-5078: This vulnerability stems from the failure of the package to sanitize the :remote-user token before writing it to the log output. By embedding carriage return or line feed characters within the Authorization: Basic header, an external actor can manipulate the output file structure. This technique corrupts the one-request-per-line logging convention, potentially masking malicious activities or injecting deceptive entries into critical system records. The vulnerability affects standard configurations, including common and default logging formats, presenting a significant threat to audit trail reliability across any system utilizing this logging component.[emaillocker id="1283"]
Immediate remediation is essential to maintain the integrity of security logs and ensure accurate event monitoring. The persistence of unneutralized control characters allows for subtle yet impactful log tampering, which could complicate incident response and forensic investigations. Updating to the patched version is necessary to close this vector and restore trust in the system's logging operations.
We recommend you to upgrade morgan to version 1.11.0.
The following reports contain further technical details:
[/emaillocker]