CVE-2026-5078

{
  "id": "CVE-2026-5078",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-5078",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:16:59.663217Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "affectedData": [
        {
          "vendor": "morgan",
          "product": "morgan",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.10.1"
            },
            {
              "status": "unaffected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/morgan",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-03T08:16:19.743",
  "references": [
    {
      "url": "https://cna.openjsf.org/security-advisories.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    },
    {
      "url": "https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user."
    },
    {
      "lang": "es",
      "value": "Impacto: El token :remote-user del middleware de registro morgan extrae el nombre de usuario de autenticación Basic del encabezado de solicitud de autorización y lo escribe en el flujo de registro sin neutralizar los caracteres de control. Un atacante no autenticado puede enviar un encabezado Authorization Basic manipulado que contiene bytes CR o LF para inyectar líneas de registro falsificadas, rompiendo la estructura de una solicitud por línea de los registros de acceso y permitiendo la falsificación de registros contra los consumidores de registros posteriores. Los formatos integrados combined, common, default y short se ven afectados, así como cualquier formato personalizado que haga referencia a :remote-user. Versiones afectadas: morgan 1.2.0 hasta 1.10.1. Parches: actualizar a morgan 1.11.0, que neutraliza los caracteres de control en la salida del token :remote-user. Soluciones alternativas: usar una cadena de formato personalizada que no incluya :remote-user."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB39C2E2-D0C6-4871-944A-08DBC91BC438",
              "versionEndExcluding": "1.11.0",
              "versionStartIncluding": "1.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"
}