Skip to main content
cve.nowby Sazabi
← npm
npmPackage

morgan

4 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 medium
Weekly downloads
17.6M
Dependents
31.1K
Registry
npm

Advisories 4

  • CVE-2026-87859Medium 5.3

    morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

    Affected: fixed in 1.12.1.

  • CVE-2026-15603Medium 5.3

    morgan vulnerable to Log Forging via unescaped Unicode line separators

    Affected: fixed in 1.12.0.

  • CVE-2026-5078Medium 5.3

    morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

    Affected: from 1.2.0, fixed in 1.11.0.

  • An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

    Affected: fixed in 1.9.1.