Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-5078
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- ❌ morgan-1.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Publish Date: 2026-06-03
URL: CVE-2026-5078
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4vj7-5mj6-jm8m
Release Date: 2026-06-03
Fix Resolution: 1.11.0
Step up your Open Source Security Game with Mend here
CVE-2026-15603
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- ❌ morgan-1.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.
Publish Date: 2026-08-28
URL: CVE-2026-15603
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-jxfw-x594-9x9m
Release Date: 2026-08-28
Fix Resolution: morgan - 1.12.0,https://github.com/expressjs/morgan.git - 1.12.0
Step up your Open Source Security Game with Mend here
CVE-2025-7339
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- morgan-1.10.0.tgz (Root Library)
- ❌ on-headers-1.0.2.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Publish Date: 2026-06-03
URL: CVE-2026-5078
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4vj7-5mj6-jm8m
Release Date: 2026-06-03
Fix Resolution: 1.11.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.
Publish Date: 2026-08-28
URL: CVE-2026-15603
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jxfw-x594-9x9m
Release Date: 2026-08-28
Fix Resolution: morgan - 1.12.0,https://github.com/expressjs/morgan.git - 1.12.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here