CVE-2026-5078

A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking one-request-per-line log structure and enabling log forgery against downstream consumers.

The morgan npm logging middleware is vulnerable to log forgery via unneutralized control characters in the :remote-user token extracted from Basic Authorization headers. A remote unauthenticated attacker can send crafted requests to inject forged log lines, impacting log integrity. Built-in combined, common, default, and short formats are affected; fixed in morgan 1.11.0. Affects ODF mcg-core, RHDH, hummingbird nodejs, cryostat, AAP portal, and other npm morgan consumers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.