CVE Explorer
CVE-2026-5078
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","packageURL":"pkg:npm/morgan","product":"morgan","vendor":"morgan","versions":[{"lessThanOrEqual":"1.10.1","status":"affected","version":"1.2.0","versionType":"semver"},{"status":"unaffected","version":"1.11.0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3daa27310971282c56326e9db0c7f63b12396e384dbb7cf98cfebfd91acf787d · sha256:4171d3018047c6b1… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3daa27310971282c56326e9db0c7f63b12396e384dbb7cf98cfebfd91acf787d · sha256:4171d3018047c6b1… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-117","description":"CWE-117: Improper Output Neutralization for Logs","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3daa27310971282c56326e9db0c7f63b12396e384dbb7cf98cfebfd91acf787d · sha256:4171d3018047c6b1… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"https://cna.openjsf.org/security-advisories.html"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3daa27310971282c56326e9db0c7f63b12396e384dbb7cf98cfebfd91acf787d · sha256:4171d3018047c6b1… · /containers/cna/references/1
{"url":"https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3daa27310971282c56326e9db0c7f63b12396e384dbb7cf98cfebfd91acf787d · sha256:4171d3018047c6b1… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.