Morgan implements its own log token escaping but fails to neutralize Unicode line separator characters (U+0085, U+2028, U+2029). An unauthenticated remote client can inject these control characters into an attacker-controlled token such as a Basic auth username. The downstream log processing – which is Unicode-aware – splits the single request log entry into multiple logical records, effectively forging logs. This flaw allows an attacker to hide malicious activity or mislead auditors, representing a medium-severity integrity violation (CWE-117).

The affected product is the Morgan HTTP request logger middleware for Node.js. Any installation of Morgan prior to version 1.12.0 is vulnerable. The issue is resolved starting in version 1.12.0, which expands the escaping set to cover the problematic Unicode line separators.

The CVSS score of 5.3 indicates a moderate risk, and the lack of an EPSS score suggests limited publicly known exploitation activity. The vulnerability is not listed in the CISA KEV catalog, further indicating it has not yet been widely exploited. An attacker can exploit this weakness via an unauthenticated HTTP request that contains the offending Unicode characters. Given the moderate severity and the ease of triggering the vulnerable code path, the risk warrants timely remediation but does not represent an immediate high-impact threat.