ROOT-APP-NPM-CVE-2019-5413 CVE-2019-5413 in morgan - Patched by Root

Root has patched CVE-2019-5413 in the morgan package for Root:npm. Multiple fixed versions available...

CLSA-2026-1784682761 TuxCare security update for morgan (1 CVE)

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.6.1-tuxcare.2...

CLSA-2026-1784596308 TuxCare security update for morgan (1 CVE)

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.6.1-tuxcare.1...

CLSA-2026-1783904625 TuxCare security update for morgan (1 CVE)

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.2...

CLSA-2026-1773620211 TuxCare security update for morgan (1 CVE)

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.1...

PT-2026-75381

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.2...

PT-2026-73982

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.5.3-tuxcare.1...

PT-2026-75552

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.6.1-tuxcare.2...

PT-2026-75529

TuxCare rebuilt morgan to address 1 CVE. Fixed in 1.6.1-tuxcare.1...

morgan: morgan: Log forgery due to unneutralized control characters

A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +6003 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =12.2.2 and more Source cves: CVE-2026-5078 Source advisory: OSV:GHSA-4VJ7-5MJ6-JM8M...

NPM: morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

NPM: morgan vulnerable to Log Forging via unneutralized control characters in :remote-user vulnerability discovered by ? in WordPress Npm morgan versions = 1.2.0, = 1.10.1...

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Impact Morgan's :remote-user token extracts the Basic auth username from the Authorization header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted Authorization: Basic header containing CR/LF characters to inject forged log lines, corrupting...

EUVD-2026-34067

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user...

MAL-2026-6859 Malicious code in older_morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44340068d23f1fff8b2fb707922053997b84f75575607966ba888f15feafbd8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-5078

A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking...

Linux Distros Unpatched Vulnerability : CVE-2026-5078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log strea...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +6003 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =12.2.2 and more Source cves: CVE-2026-5078 Source advisory: SNYK:JS-MORGAN-17135841...

Improper Output Neutralization for Logs

Overview morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the :remote-user token, which extracts the Basic auth username from the Authorization header and writes it to the log stream without...

CVE-2026-5078

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...