4vulnerabilities
- Critical1 (25.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate3 (75.0%)
- Low0 (0.0%)
morgan
Ecosystem: npm
Downloads: 58.52 Mln
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting morgan, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-9f6g-j8ch-79g4 | Moderate | morgan vulnerable to Log Injection via unescaped double quote in quoted log fields### Impact Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0) neutralizes control characters, the Unicode line separators, and backslash, but not the double quote (`0x22`), which is the field delimiter of the Apache combined log format morgan emits. An attacker who controls a quoted field (`:user-agent`, `:referrer`, the request URL, or the Basic auth `:remote-user`) can inject a double quote to close the field early and forge additional fields in the log record. The `combined`, `common`, and `default` formats, and any custom format tha |
| GitHub (opens in a new tab) | |
| GHSA-jxfw-x594-9x9m | Moderate | morgan vulnerable to Log Forging via unescaped Unicode line separators### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators `U+0085` (NEL), `U+2028` (LINE SEPARATOR), or `U+2029` (PARAGRAPH SEPARATOR). These code points are reachable through several tokens, including the request URL (`:url`), request headers such as `:user-agent` and `:referrer`, arbitrary `:req[header]` values, and the Basic auth username (`:remote-user`). NEL is valid `obs-text` in HTTP header values, so an attacker can place it in |
| GitHub (opens in a new tab) | |
| GHSA-4vj7-5mj6-jm8m | Moderate | morgan vulnerable to Log Forging via unneutralized control characters in :remote-user### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs. The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`. ### Patches Users should upgrade to version 1.11.0. ### Workarounds Use a custom format string th |
| GitHub (opens in a new tab) | |
| GHSA-gwg9-rgvj-4h5j | Critical | Code Injection in morganVerisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. ## Recommendation Update to version 1.9.1 or later. |
| GitHub (opens in a new tab) |
- GHSA-9f6g-j8ch-79g4Moderatemorgan vulnerable to Log Injection via unescaped double quote in quoted log fields
< 1.12.1
### Impact Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0) neutralizes control characters, the Unicode line separators, and backslash, but not the double quote (`0x22`), which is the field delimiter of the Apache combined log format morgan emits. An attacker who controls a quoted field (`:user-agent`, `:referrer`, the request URL, or the Basic auth `:remote-user`) can inject a double quote to close the field early and forge additional fields in the log record. The `combined`, `common`, and `default` formats, and any custom format tha
CVE: CVE-2026-87859
- GHSA-jxfw-x594-9x9mModeratemorgan vulnerable to Log Forging via unescaped Unicode line separators
< 1.12.0
### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators `U+0085` (NEL), `U+2028` (LINE SEPARATOR), or `U+2029` (PARAGRAPH SEPARATOR). These code points are reachable through several tokens, including the request URL (`:url`), request headers such as `:user-agent` and `:referrer`, arbitrary `:req[header]` values, and the Basic auth username (`:remote-user`). NEL is valid `obs-text` in HTTP header values, so an attacker can place it in
CVE: CVE-2026-15603
- GHSA-4vj7-5mj6-jm8mModeratemorgan vulnerable to Log Forging via unneutralized control characters in :remote-user
>= 1.2.0, < 1.11.0
### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted `Authorization: Basic` header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs. The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`. ### Patches Users should upgrade to version 1.11.0. ### Workarounds Use a custom format string th
CVE: CVE-2026-5078
Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. ## Recommendation Update to version 1.9.1 or later.
CVE: CVE-2019-5413