Morgan_project Morgan
2 CVEs affecting Morgan_project Morgan. Latest disclosed: 2026-06-03. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5413 | Critical | 9.8 | 2019-03-21 | An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. |
CVE-2026-5078 | Medium | 5.3 | 2026-06-03 | Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stre… |