CVE-2026-5078: Morgan Middleware Log Injection Vulnerability

CVE-2026-5078 Overview

CVE-2026-5078 is a log injection vulnerability [CWE-117] in the morgan HTTP request logging middleware for Node.js. The :remote-user token extracts the Basic authentication username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can submit a crafted Authorization: Basic header containing carriage return (CR) or line feed (LF) bytes to inject forged entries into access logs. The flaw affects morgan versions 1.2.0 through 1.10.1 and impacts the built-in combined, common, default, and short formats, plus any custom format that references :remote-user.

Critical Impact
Remote unauthenticated attackers can forge access log entries, breaking log integrity and misleading downstream log consumers, SIEMs, and incident responders.

Affected Products

morgan 1.2.0 through 1.10.1 (npm package)
Express.js applications using morgan with combined, common, default, or short formats
Any application using a custom morgan format string referencing :remote-user

Discovery Timeline

2026-06-03 - CVE-2026-5078 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-5078

Vulnerability Analysis

The morgan middleware writes one log line per HTTP request. The :remote-user token resolves the username portion of HTTP Basic authentication credentials carried in the Authorization header. Before version 1.11.0, morgan decoded the Base64 payload and emitted the username directly to the log stream without sanitization.

An attacker controls the entire Base64 payload of the Authorization: Basic header. By embedding CR (\r, 0x0D) or LF (\n, 0x0A) bytes in the username portion, the attacker terminates the current log line early and writes attacker-controlled content as a separate, forged log entry. Downstream parsers, log shippers, and SIEM rules treat the injected line as a legitimate request record.

Root Cause

The root cause is improper output neutralization of control characters in log files [CWE-117]. The :remote-user token formatter did not strip or encode bytes that have structural meaning in line-oriented log formats. Because the Authorization header is processed before authentication succeeds, the vulnerability is reachable without credentials.

Attack Vector

Exploitation requires a single HTTP request to any endpoint protected or monitored by a vulnerable morgan instance. The attacker crafts an Authorization: Basic header where the Base64-decoded payload contains a username with embedded CRLF sequences followed by a fabricated log line, then a colon to satisfy the username:password structure. When morgan writes the request, the injected newline splits the entry, producing one truncated genuine line and one or more attacker-controlled lines. This can be used to hide malicious activity, frame other IP addresses, or inject content that breaks log parsers.

No verified public exploit code is referenced in the advisory. Technical details are available in the GitHub Security Advisory GHSA-4vj7-5mj6-jm8m and the OpenJS Foundation Security Advisories.

Detection Methods for CVE-2026-5078

Indicators of Compromise

Access log entries containing unexpected line breaks within the user field or malformed request lines that do not match the configured morgan format.
Log lines where the remote user value contains non-printable characters, embedded HTTP method tokens, or duplicated timestamp patterns.
Authorization: Basic request headers whose Base64-decoded payload contains 0x0A or 0x0D bytes before the : separator.

Detection Strategies

Parse stored access logs and flag any line where the :remote-user field contains control characters or whitespace inconsistent with valid HTTP Basic usernames.
Inspect raw HTTP traffic at proxies or WAFs for Authorization headers whose Base64 payload decodes to data containing CR or LF bytes.
Compare line counts between morgan output and upstream proxy logs for the same time window — discrepancies indicate possible injection.

Monitoring Recommendations

Forward morgan output through a structured log shipper that enforces schema validation and quarantines malformed entries.
Alert on any successful request where the parsed remote-user value contains non-ASCII or control bytes.
Audit package-lock.json and yarn.lock files across Node.js services for morgan versions in the 1.2.0–1.10.1 range.

How to Mitigate CVE-2026-5078

Immediate Actions Required

Upgrade morgan to version 1.11.0 or later in all Node.js services and rebuild deployment artifacts.
Inventory all applications using morgan and identify formats that reference :remote-user, including custom formats.
Review existing access logs for injected entries and treat affected logs as potentially tampered until validated.

Patch Information

The fix is available in morgan 1.11.0, which neutralizes control characters in the :remote-user token output before writing to the log stream. Update the dependency via npm install morgan@^1.11.0 or by adjusting the version constraint in package.json and regenerating the lockfile. Details are documented in GitHub Security Advisory GHSA-4vj7-5mj6-jm8m.

Workarounds

Replace the active morgan format with a custom format string that omits the :remote-user token until patching is complete.
Strip or reject Authorization headers containing CR or LF bytes at an upstream proxy, WAF, or middleware layer.
Disable HTTP Basic authentication on endpoints where it is not required, eliminating attacker control of the :remote-user value.

bash

# Upgrade morgan to the patched version
npm install morgan@^1.11.0

# Verify installed version
npm ls morgan

# Temporary mitigation: use a custom format without :remote-user
# app.use(morgan(':remote-addr - [:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length]'))