Is CVE-2026-5078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5078 being exploited in the wild.

How severe is CVE-2026-5078?

Medium severity, with a CVSS score of 5.3, published 3 June 2026.

Which products and versions are affected?

morgan (npm) SEMVER:introduced=1.2.0,fixed=1.11.0; OpenJS Foundation Morgan 1.2.0 - 1.10.1.

Is there a fix for CVE-2026-5078?

Yes. morgan (npm): upgrade to 1.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5078 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5078?

Check whether you run morgan (npm) or OpenJS Foundation Morgan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5078: OpenJS morgan log forgery via unneutralized :remote-user token

CVE-2026-5078 · Severity: medium · CVSS 5.3 · Published 2026-06-03

Morgan is an HTTP request logger middleware for Node.js applications. The :remote-user token in Morgan writes usernames from the Authorization header directly to logs without filtering control characters. An attacker can inject carriage return and line feed characters via a crafted Authorization header to forge additional log entries, corrupting the integrity of access logs and potentially masking malicious activity or injecting false events into monitoring systems.

Technologies: morgan (npm), OpenJS Foundation Morgan. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-5078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5078 being exploited in the wild.
How severe is CVE-2026-5078?: Medium severity, with a CVSS score of 5.3, published 3 June 2026.
Which products and versions are affected?: morgan (npm) SEMVER:introduced=1.2.0,fixed=1.11.0; OpenJS Foundation Morgan 1.2.0 - 1.10.1.
Is there a fix for CVE-2026-5078?: Yes. morgan (npm): upgrade to 1.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5078 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5078?: Check whether you run morgan (npm) or OpenJS Foundation Morgan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

morgan (npm): upgrade to 1.11.0 or later
```
npm install morgan@1.11.0
```

Technical details

This is a log forging vulnerability (CWE-117) in the morgan HTTP request logger. The vulnerability exists in the :remote-user token which extracts the Basic authentication username from the Authorization header and writes it to the log stream without sanitizing control characters, specifically CR (carriage return, \r, 0x0D) and LF (line feed, \n, 0x0A) characters. An unauthenticated attacker can send a crafted Authorization: Basic header containing these control characters to inject forged log lines, breaking the one-request-per-line structure of access logs. The built-in combined, common, default, and short formats are affected, as well as custom formats that include :remote-user. An attacker must be able to reach the web service to send the malicious header (network-accessible, no authentication required). The fix is to upgrade to version 1.11.0 or later, or use a custom format string that excludes :remote-user.

Affected products

expressjs morgan >=1.2.0, <=1.10.1

Identifiers

CVE-2026-5078
GHSA-4vj7-5mj6-jm8m

Timeline

2026-06-02: disclosed
2026-07-10: advisory
2026-07-10: patched: fixed in version 1.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.