CVE-2026-15603: 
Node.js vulnerability analysis and mitigation

CVE-2026-15603 is a log forging vulnerability (CWE-117) in morgan, the HTTP request logger middleware for Node.js. The flaw exists in versions prior to 1.12.0, where the internal log token escaping helper fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). This is an incomplete-fix follow-up to CVE-2026-5078, which previously only addressed ASCII control characters. It was disclosed on August 28, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper output neutralization for logs (CWE-117): morgan's internal escaping helper, updated in version 1.11.0 to handle C0 control characters, DEL, and backslash, did not extend coverage to Unicode line terminators recognized by ECMAScript-aware parsers. An unauthenticated attacker can embed U+0085, U+2028, or U+2029 into attacker-controlled log tokens — including the request URL (:url), request headers (:user-agent, :referrer, arbitrary :req[header]), and the Basic auth username (:remote-user) — since NEL (U+0085) is valid obs-text in HTTP header values per RFC. When these values are written to the access log, downstream Unicode-aware or ECMAScript-aware log processors split the single physical log record into multiple logical records, enabling log forging. All built-in formats (combined, common, default, short) and custom formats are affected (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to forge log entries, causing downstream log processing systems to interpret a single HTTP request as multiple distinct log records. This can be used to obscure malicious activity, inject false audit trail entries, or manipulate security monitoring and SIEM systems that rely on access logs for threat detection. There is no direct confidentiality or availability impact; the integrity impact is limited to log data (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is automatable (no user interaction or privileges required), making it trivially reachable by any remote client. The EPSS score is approximately 0.235%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate a Node.js application using morgan middleware (any version < 1.12.0) that logs HTTP requests to a downstream Unicode-aware log processor (e.g., a SIEM, log aggregator, or ECMAScript-based log parser).
2. Craft malicious request: Construct an HTTP request containing a Unicode line separator character (U+0085, U+2028, or U+2029) in an attacker-controlled field. For example, set the Basic auth username to legitimateuser\u2028[FORGED LOG ENTRY] or embed the character in a custom request header.
3. Send the request: Transmit the crafted HTTP request to the target application. No authentication or special privileges are required.
4. Log forging achieved: Morgan logs the raw token value including the unescaped Unicode separator. When the downstream log processor parses the log, it splits the single physical record at the Unicode line separator, treating the injected content as a separate, legitimate-looking log entry — effectively forging the audit trail (GitHub Advisory).

• Network: HTTP requests with Unicode characters U+0085, U+2028, or U+2029 embedded in headers (e.g., Authorization, User-Agent, Referer) or the request URL targeting applications using morgan middleware.
• Logs: Access log records that appear to contain unexpected line breaks or split into multiple logical entries when processed by Unicode-aware parsers; log entries with unusual or mismatched field counts relative to the configured format.
• Logs: Presence of raw Unicode code points \u0085, \u2028, or \u2029 in raw access log files when inspected with a hex editor or binary-aware tool.

Upgrade morgan to version 1.12.0 or later, which extends the escaping set to cover Unicode line separators U+0085, U+2028, and U+2029 in addition to the ASCII control characters addressed in 1.11.0. There are no practical format-based workarounds, as the affected values (request URL and headers) are core to access logging. As a defense-in-depth measure, implement log validation and integrity checks on downstream log processing systems to detect unexpected record boundaries or suspicious log patterns (GitHub Advisory, Red Hat Bugzilla).

The advisory was published by UlisesGascon on the expressjs/morgan GitHub repository, with remediation review credited to jonchurch and bjohansebas, and the vulnerability reported by mfazrinizar and iaohkut-from-NightWolf-Team. Red Hat opened a tracking bug (BZ#2525625) and assigned it medium severity, indicating downstream package impact assessment is ongoing. No significant broader media coverage or notable social media discussion has been observed (GitHub Advisory, Red Hat Bugzilla).