Morgan Project Morgan
3 CVEs affecting Morgan Project Morgan. Latest disclosed: 2026-08-28. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5413 | Critical | 9.8 | 2019-03-21 | An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. |
CVE-2026-15603 | Medium | 5.3 | 2026-08-28 | morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the… |
CVE-2026-5078 | Medium | 5.3 | 2026-06-03 | Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stre… |