Morgan
by Expressjs
Source repositories
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5413 | Cri | 0.64 | 9.8 | 0.03 | Mar 21, 2019 | An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. | ||
| CVE-2026-5078 | Med | 0.34 | 5.3 | 0.00 | Jun 3, 2026 | Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header… | ||
| CVE-2026-87859 | Med | 0.27 | 5.3 | 0.00 | Sep 11, 2026 | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker… | ||
| CVE-2026-15603 | Med | 0.27 | 5.3 | 0.00 | Aug 28, 2026 | morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An… |
- risk 0.64cvss 9.8epss 0.03
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
- risk 0.34cvss 5.3epss 0.00
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header…
- risk 0.27cvss 5.3epss 0.00
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker…
- risk 0.27cvss 5.3epss 0.00
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An…