CVE-2026-15603: 
JavaScript vulnerability analysis and mitigation

CVE-2026-15603 is a log forging vulnerability (CWE-117) in morgan, the HTTP request logger middleware for Node.js. The internal helper responsible for escaping log token values fails to neutralize three Unicode line separator characters — U+0085 (Next Line/NEL), U+2028 (Line Separator), and U+2029 (Paragraph Separator) — allowing an unauthenticated remote attacker to inject these characters into attacker-controlled log tokens and cause downstream log processors to split a single access-log record into multiple logical records. All versions of morgan prior to 1.12.0 are affected. It carries a CVSS v3.1 base score of 5.3 (Medium) and was publicly disclosed on August 28, 2026 (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-117 (Improper Output Neutralization for Logs). Morgan's prior fix in version 1.11.0 (addressing CVE-2026-5078) neutralized ASCII C0 control characters, DEL, and backslash, but omitted the Unicode line terminators U+0085, U+2028, and U+2029, which ECMAScript and many Unicode-aware log parsers treat as line boundaries. These characters are reachable through multiple log tokens: :url (request URL), :user-agent, :referrer, arbitrary :req[header] values, and :remote-user (Basic auth username). Because U+0085 (NEL) is valid obs-text in HTTP header values per RFC 7230, an attacker can embed it in a standard request header without triggering HTTP-level rejection. When morgan writes the log record, the raw code points survive into the output, and any downstream Unicode-aware log pipeline (e.g., a SIEM or log aggregator) splits the single physical line into multiple logical records, enabling log entry forgery (GitHub Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to forge access log entries, causing a single HTTP request to appear as multiple distinct log records in downstream log processing systems. This can be used to obscure malicious activity (e.g., hiding attack requests among injected benign-looking entries), inject false audit trail records, or disrupt log-based alerting and forensic analysis. There is no direct confidentiality or availability impact; the integrity impact is limited to log data. All built-in morgan log formats (combined, common, default, short) and any custom format are affected (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.235%, placing it in the 15th percentile for exploitation likelihood within 30 days (Github Advisory). The attack is automatable (no user interaction or privileges required), but the impact is limited to log integrity, reducing overall exploitation incentive.

1. Identify target: Locate a Node.js web application using morgan as its HTTP request logger middleware (any version < 1.12.0) that forwards access logs to a Unicode-aware log processing system (e.g., Elasticsearch, Splunk, or a SIEM).
2. Select injection vector: Choose an attacker-controllable log token. The Basic auth username (:remote-user), request URL (:url), User-Agent header (:user-agent), Referer header (:referrer), or any arbitrary request header via :req[header] are all viable.
3. Craft malicious request: Construct an HTTP request embedding one or more Unicode line separator characters (U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR) in the chosen field. For example, set the User-Agent header to: Mozilla/5.0
GET /admin HTTP/1.1 to inject a fake subsequent log line.
4. Send the request: Transmit the crafted HTTP request to the target server. Morgan logs the raw token value without escaping the Unicode separators.
5. Observe log forging: In the downstream log processor, the single physical log record is split at the injected separator, causing the injected content to appear as a separate, independent log entry — effectively forging a log record or hiding the original request among fabricated entries (GitHub Advisory).

• Network: HTTP requests containing raw Unicode code points U+0085, U+2028, or U+2029 in headers (e.g., User-Agent, Referer, custom headers) or the request URL; Basic auth credentials containing these characters in the username field.
• Logs: Access log records that appear to begin mid-entry or contain unexpected line breaks when viewed in a raw/hex editor; log entries with unusually short or malformed fields immediately following a legitimate-looking record; duplicate or inconsistent timestamps in sequential log lines that originated from a single request.
• Log Processing Systems: Unexpected increase in log record count relative to actual request volume; SIEM alerts or parsing errors related to malformed log entries; log lines missing standard fields (e.g., status code, response size) that would be present in a complete morgan log record.

The fix is available in morgan version 1.12.0, which extends the character escaping set to include U+0085, U+2028, and U+2029 in addition to the ASCII control characters addressed in 1.11.0. Upgrade immediately using npm install morgan@1.12.0 or update the dependency in package.json. There are no viable format-based workarounds, as the affected values (request URL and headers) are fundamental to access logging and cannot be excluded without losing core functionality. As a defense-in-depth measure, implement log validation and integrity checks in downstream log processing pipelines to detect unexpected record boundaries (GitHub Advisory, Red Hat Bugzilla).

The advisory was published by UlisesGascon on behalf of the expressjs/morgan project and reviewed by jonchurch and bjohansebas, with the fix developed by bjohansebas (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2525625) and assigned it medium priority/severity (Red Hat Bugzilla). The vulnerability was also picked up by Tenable (Nessus plugin 341554) and the AWS dynamic image transformation solution released v8.1.1 referencing this CVE, indicating downstream ecosystem awareness.