Executive brief
Morgan is a widely-used HTTP request logging middleware for Express.js applications. A vulnerability in versions before 1.12.0 allows attackers to inject Unicode line-separator characters into access logs through request headers and URLs, causing log parsing tools to incorrectly split single log entries into multiple entries. This enables attackers to forge log records and potentially hide malicious activity from audit systems and security monitoring.
Technical details
Morgan's access logging suffers from improper output neutralization (CWE-117). While version 1.11.0 addressed C0 control characters, DEL, and backslash, it failed to escape Unicode line separators: U+0085 (NEL), U+2028 (LINE SEPARATOR), and U+2029 (PARAGRAPH SEPARATOR). These characters can be embedded in HTTP request headers (valid as obs-text per HTTP specs), the request URL, and Basic authentication usernames. When these code points are written to the access log, downstream log analysis tools that are ECMAScript or Unicode-aware interpret them as line breaks, splitting a single physical log record into multiple logical records. This allows attackers to inject forged log entries. No user interaction is required; an attacker only needs network access to send a crafted HTTP request. The fix is available in version 1.12.0.
Affected products
- Express.js morgan < 1.12.0
Timeline
- 2026-08-28: disclosed
- 2026-09-08: patched: Version 1.12.0 released