CVE-2026-15603: Morgan Package Vulnerable to Log Forging via Unescaped Unicode Line Separators
Summary
CVE-2026-15603: morgan vulnerable to Log Forging via unescaped Unicode line separators. Affects morgan versions < 1.12.0. Fixed in 1.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Morgan is a popular logging middleware for Node.js applications, designed to simplify the logging of HTTP requests. It provides various logging formats and is widely used in web applications to track request data. However, it has a vulnerability that allows attackers to manipulate log entries through specific Unicode characters, which can lead to log forgery.
Vulnerability Detail
Morgan writes attacker-controlled request data to the access log through its tokens. The vulnerability arises because the fix in version 1.11.0 only neutralizes certain control characters but fails to escape Unicode line separators such as U+0085 (NEL), U+2028 (LINE SEPARATOR), and U+2029 (PARAGRAPH SEPARATOR). Attackers can exploit this by including these characters in request headers or URLs, allowing them to forge log entries by splitting a single log record into multiple logical records during processing.
How To Fix
Latest published version: 1.12.1 as of 23 Oct 2026
npm install morgan@1.12.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.0
This is the first release that contains the fix.
npm install morgan@1.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no practical workarounds for this vulnerability, as the affected values include core components of access logging such as request URLs and headers. The only effective solution is to upgrade to version 1.12.0.
Conclusion
The Morgan package has a vulnerability (CVE-2026-15603) that allows log forgery through unescaped Unicode line separators. Users are strongly advised to upgrade to version 1.12.0 to mitigate this risk, as there are no practical workarounds available.
See every vulnerability recorded for morgan →
FAQ
CVE-2026-15603 is a vulnerability in the Morgan logging middleware that allows attackers to forge log entries by exploiting unescaped Unicode line separators.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The vulnerability can lead to log forgery, where attackers can manipulate log entries, potentially hiding malicious activities or creating false records.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
There are no effective workarounds for this vulnerability. The only solution is to upgrade to the patched version 1.12.0.
References
Related vulnerabilities
Recent vulnerabilities recorded for morgan.
