npm · morgan
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Morgan's :remote-user token extracts the Basic auth username from the Authorization header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted Authorization: Basic header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs.
The built-in combined, common, default, and short formats are affected, as well as any custom format that includes :remote-user.
Users should upgrade to version 1.11.0.
Use a custom format string that does not include :remote-user.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.