Executive brief
Morgan is an HTTP request logger middleware for Node.js applications. The :remote-user token in Morgan writes usernames from the Authorization header directly to logs without filtering control characters. An attacker can inject carriage return and line feed characters via a crafted Authorization header to forge additional log entries, corrupting the integrity of access logs and potentially masking malicious activity or injecting false events into monitoring systems.
Technical details
This is a log forging vulnerability (CWE-117) in the morgan HTTP request logger. The vulnerability exists in the :remote-user token which extracts the Basic authentication username from the Authorization header and writes it to the log stream without sanitizing control characters, specifically CR (carriage return, \r, 0x0D) and LF (line feed, \n, 0x0A) characters. An unauthenticated attacker can send a crafted Authorization: Basic header containing these control characters to inject forged log lines, breaking the one-request-per-line structure of access logs. The built-in combined, common, default, and short formats are affected, as well as custom formats that include :remote-user. An attacker must be able to reach the web service to send the malicious header (network-accessible, no authentication required). The fix is to upgrade to version 1.11.0 or later, or use a custom format string that excludes :remote-user.
Affected products
- expressjs morgan >=1.2.0, <=1.10.1
Timeline
- 2026-06-02: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: fixed in version 1.11.0