CVE-2026-86522

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

EUVD-2026-81482

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

UBUNTU-CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

EUVD-2026-67720

morgan vulnerable to Log Forging via unescaped Unicode line separators...

morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-15603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the...

Improper Output Neutralization for Logs

Overview morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in its format-token expansion, which does not neutralize the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, and U+2029 PARAGRAPH...

DEBIAN-CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

UBUNTU-CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan (HTTP request logger middleware for Node.js) is affected by a log forging issue (CWE-117) in versions prior to 1.12.0 . The internal helper that escapes log token values failed to neutralize Unicode line separator characters U+0085 , U+2028 , and U+2029 . An unauthenticated remote client c...

PT-2026-83120

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.0 Description An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragrap...

CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866

@fastify/busboy (a multipart form-data parser for Node.js) is vulnerable to CRLF injection via the Content-Disposition filename and field name. The part-header parser splits lines only on the two-byte CRLF sequence, so a lone carriage return or line feed embedded in a part header is carried verba...