CVE-2026-15603 Overview
CVE-2026-15603 is a log forging vulnerability in morgan, an HTTP request logger middleware for Node.js. Versions prior to 1.12.0 fail to escape Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) in log token values. An unauthenticated remote attacker can inject these characters through attacker-controlled log tokens, such as a Basic auth username surfaced via the remote-user token. Unicode-aware downstream log processors then split a single request record into multiple logical entries, enabling log forgery [CWE-117].
Critical Impact
Attackers can forge log entries in downstream log processing pipelines, undermining audit integrity and enabling concealment of malicious activity.
Affected Products
- morgan (npm package) versions prior to 1.12.0
- Node.js applications using morgan as HTTP request logging middleware
- Express.js deployments relying on morgan for access logging
Discovery Timeline
- 2026-08-28 - CVE-2026-15603 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-15603
Vulnerability Analysis
The flaw resides in morgan's internal helper that escapes log token values before writing them to the output stream. The escaping routine neutralizes ASCII control characters but does not cover Unicode line separators. When a log aggregator or SIEM parser applies Unicode-aware line splitting, characters such as U+2028 are treated as record boundaries. An attacker who controls any tokenized value can inject these characters and produce fabricated log lines that appear legitimate to downstream consumers.
This issue is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters. The vendor extended the escape set in version 1.12.0 to include U+0085, U+2028, and U+2029.
Root Cause
The root cause is insufficient output neutralization for logs [CWE-117]. The escape function assumes ASCII-oriented line semantics, while modern log processors (Java, .NET, Python, and many SIEM ingestion pipelines) split lines on Unicode separators. This mismatch between producer and consumer parsing rules allows a single crafted HTTP request to yield multiple log records.
Attack Vector
An unauthenticated remote attacker submits an HTTP request containing a Unicode line separator inside a value that morgan logs, such as the Authorization: Basic header username exposed through the remote-user token, the User-Agent, Referer, or a URL parameter. The response is not required; log ingestion alone completes the attack. Forged records can impersonate other users, hide reconnaissance, or trigger false detections in log-driven automation.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-jxfw-x594-9x9m for technical details.
Detection Methods for CVE-2026-15603
Indicators of Compromise
- Log records containing raw or percent-encoded U+0085, U+2028, or U+2029 bytes (\\xc2\\x85, \\xe2\\x80\\xa8, \\xe2\\x80\\xa9) in request fields.
- Unexpected log lines lacking a preceding HTTP status code or timestamp, suggesting a forged continuation record.
- Authentication log entries showing usernames that include non-printable Unicode whitespace.
Detection Strategies
- Parse ingested logs with a Unicode-aware tokenizer and flag any request-derived field containing category Zl, Zp, or NEL characters.
- Correlate the count of morgan output lines against the count of HTTP requests served; a divergence indicates injected line breaks.
- Alert on Basic auth usernames or User-Agent values whose byte length exceeds their visible character length by unusual margins.
Monitoring Recommendations
- Ingest morgan output through a pipeline that normalizes or rejects Unicode line separators before indexing.
- Track the installed morgan version across Node.js services via software composition analysis and alert on versions below 1.12.0.
- Monitor for repeated failed authentication attempts where credentials contain multibyte UTF-8 sequences.
How to Mitigate CVE-2026-15603
Immediate Actions Required
- Upgrade morgan to version 1.12.0 or later across all Node.js services.
- Audit application logs written since deployment for injected Unicode separators and validate audit records used in investigations.
- Review any log-driven automation, such as SIEM correlation or SOAR playbooks, for decisions influenced by potentially forged records.
Patch Information
The maintainers fixed the issue in morgan 1.12.0 by extending the escape set to cover U+0085, U+2028, and U+2029. Refer to the GitHub Security Advisory GHSA-jxfw-x594-9x9m and the OpenJS Foundation Security Advisories for release details.
Workarounds
- Place a reverse proxy or WAF in front of the application to strip or reject requests containing Unicode line separators in headers and URLs.
- Wrap morgan tokens with a custom formatter that replaces \\u0085, \\u2028, and \\u2029 before output.
- Configure downstream log ingestion to split records only on ASCII \n rather than Unicode line boundaries.
# Upgrade morgan to the patched release
npm install morgan@^1.12.0
npm ls morgan
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.