See how morgan project compares to other vendors in security performance
Impact
Morgan's :remote-user token extracts the Basic auth username from the Authorization header and writes it to the log stream without neutralizing control characters. An attacker can send a crafted Authorization: Basic header containing CR/LF characters to inject forged log lines, corrupting the one-request-per-line structure of access logs.
The built-in combined, common, default, and short formats are affected, as well as any custom format that includes :remote-user.
Patches
Users should upgrade to version 1.11.0.
Workarounds
Use a custom format string that does not include :remote-user.
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.