EUVD-2026-67720

morgan vulnerable to Log Forging via unescaped Unicode line separators...

morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

DEBIAN-CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...

CVE-2026-15603

morgan (HTTP request logger middleware for Node.js) is affected by a log forging issue (CWE-117) in versions prior to 1.12.0 . The internal helper that escapes log token values failed to neutralize Unicode line separator characters U+0085 , U+2028 , and U+2029 . An unauthenticated remote client c...

PT-2026-83120

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.0 Description An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragrap...

HTML Injection

mailgen is vulnerable to HTML injection. The vulnerability is due to improper stripping of HTML tags in the generatePlaintext method when Unicode line-separator characters bypass the regex filter, which allows an attacker to inject unexpected HTML that can be interpreted as executable script...

CVE-2025-62380

Mailgen (Node.js) versions up to 2.0.31 expose an HTML injection/XSS risk in plaintext output generated by generatePlaintext. The plaintext cleaning code strips HTML tags with a regex, decodes HTML entities, and then replaces decoded content; however, HTML tags containing certain Unicode line sep...