Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (morgan version) |
Remediation Possible** |
| CVE-2026-5078 |
 Medium |
5.3 |
morgan-1.10.0.tgz |
Direct |
1.11.0 |
❌ |
| CVE-2025-7339 |
 Low |
3.4 |
on-headers-1.0.2.tgz |
Transitive |
1.10.1 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-5078
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- ❌ morgan-1.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Publish Date: 2026-06-03
URL: CVE-2026-5078
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4vj7-5mj6-jm8m
Release Date: 2026-06-03
Fix Resolution: 1.11.0
Step up your Open Source Security Game with Mend here
CVE-2025-7339
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- morgan-1.10.0.tgz (Root Library)
- ❌ on-headers-1.0.2.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - morgan-1.10.0.tgz
HTTP request logger middleware for node.js
Library home page: https://registry.npmjs.org/morgan/-/morgan-1.10.0.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Publish Date: 2026-06-03
URL: CVE-2026-5078
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4vj7-5mj6-jm8m
Release Date: 2026-06-03
Fix Resolution: 1.11.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here