{"action":"Upgrade morgan to 1.11.0 or later.","affected":[{"fixed":"1.11.0","introduced":"1.2.0"}],"component":"morgan","cve_ids":["CVE-2026-5078"],"ecosystem":"npm","epss":0.00332,"exploited":false,"fixed_versions":["1.11.0"],"ghsa_id":"GHSA-4vj7-5mj6-jm8m","id":"tcs_01M5KF1HDAB4E5K68BRTFPKMKS","modified_at":"2026-09-10T03:51:10.338435570Z","published_at":"2026-07-10T14:32:15Z","references":["https://osv.dev/vulnerability/GHSA-4vj7-5mj6-jm8m","https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m","https://nvd.nist.gov/vuln/detail/CVE-2026-5078","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4vj7-5mj6-jm8m","url":"https://osv.dev/vulnerability/GHSA-4vj7-5mj6-jm8m"}],"summary":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user"}