DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-15603: CVE-2026-15603: Log Forging via Unescaped Unicode Line Separators in morgan Middleware

#security #cve #cybersecurity

CVE-2026-15603: Log Forging via Unescaped Unicode Line Separators in morgan Middleware

Vulnerability ID: CVE-2026-15603
CVSS Score: 5.3
Published: 2026-09-08

An incomplete fix vulnerability (CVE-2026-15603) in the morgan HTTP request logger middleware for Node.js allows unauthenticated remote attackers to forge log entries. The flaw arises because the escaping mechanism does not neutralize Unicode line separator characters, enabling attackers to inject payloads that trick downstream log processors into splitting single log records into multiple logical entries.

TL;DR

Unauthenticated remote attackers can inject unescaped Unicode line separators into HTTP headers, forcing Unicode-aware downstream log parsers to split records and forge false logging entries in morgan versions < 1.12.0.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-117
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 5.3 (Medium)
  • EPSS Score: 0.00235 (14.34th percentile)
  • Impact: Log Forging & Injection (Integrity Loss)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • Node.js applications utilizing morgan logging middleware version < 1.12.0
  • Systems parsing morgan console outputs with Unicode-aware log ingestion agents (Elasticsearch, Fluentd, Logstash)
  • morgan: < 1.12.0 (Fixed in: 1.12.0)

Code Analysis

Commit: fbf9383

fix: escape Unicode line separators in log fields

Commit: fb9a228

ci: add NPM Publish reusable workflow

Commit: 51007f9

feat: add support for stream.writableObjectMode

Mitigation Strategies

  • Upgrade morgan package to 1.12.0 or newer.
  • Implement intermediary middleware to sanitize HTTP headers from C1 and Unicode line boundaries.
  • Deploy WAF rules blocking control and Unicode separator bytes in inbound headers.

Remediation Steps:

  1. Identify applications utilizing the 'morgan' npm library.
  2. Execute the dependency upgrade: 'npm install morgan@1.12.0' or update package.json.
  3. Verify installation of v1.12.0 in node_modules/morgan/package.json.
  4. Redeploy the application and monitor logs for correctly escaped unicode notation (e.g. \u0085).

References

Read the full report for CVE-2026-15603 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)