{"uuid": "8a67b0f4-4c44-403c-9b89-25afcc38d3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15603", "type": "seen", "source": "https://gist.github.com/alon710/b919d27f81b437b0cf80f08fd81f817b", "content": "# CVE-2026-15603: CVE-2026-15603: Log Forging via Unescaped Unicode Line Separators in morgan Middleware\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-15603\n\n## Summary\nAn incomplete fix vulnerability (CVE-2026-15603) in the morgan HTTP request logger middleware for Node.js allows unauthenticated remote attackers to forge log entries. The flaw arises because the escaping mechanism does not neutralize Unicode line separator characters, enabling attackers to inject payloads that trick downstream log processors into splitting single log records into multiple logical entries.\n\n## TL;DR\nUnauthenticated remote attackers can inject unescaped Unicode line separators into HTTP headers, forcing Unicode-aware downstream log parsers to split records and forge false logging entries in morgan versions < 1.12.0.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-117\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.3 (Medium)\n- **EPSS Score**: 0.00235 (14.34th percentile)\n- **Impact**: Log Forging & Injection (Integrity Loss)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications utilizing morgan logging middleware version < 1.12.0\n- Systems parsing morgan console outputs with Unicode-aware log ingestion agents (Elasticsearch, Fluentd, Logstash)\n- **morgan**: < 1.12.0 (Fixed in: `1.12.0`)\n\n## Mitigation\n\n- Upgrade morgan package to 1.12.0 or newer.\n- Implement intermediary middleware to sanitize HTTP headers from C1 and Unicode line boundaries.\n- Deploy WAF rules blocking control and Unicode separator bytes in inbound headers.\n\n**Remediation Steps:**\n1. Identify applications utilizing the 'morgan' npm library.\n2. Execute the dependency upgrade: 'npm install morgan@1.12.0' or update package.json.\n3. Verify installation of v1.12.0 in node_modules/morgan/package.json.\n4. Redeploy the application and monitor logs for correctly escaped unicode notation (e.g. \\u0085).\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-15603](https://www.cve.org/CVERecord?id=CVE-2026-15603)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-15603](https://nvd.nist.gov/vuln/detail/CVE-2026-15603)\n- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)\n- [https://www.wiz.io/vulnerability-database/cve/cve-2026-15603](https://www.wiz.io/vulnerability-database/cve/cve-2026-15603)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-15603) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T08:32:03.775595Z"}