zwave-js / zwave-js-ui / 33757753013

17%

push

github

fix(deps): update dependency morgan to ~1.11.0 (#4814)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [morgan](https://redirect.github.com/expressjs/morgan) | [`~1.10.0` →
`~1.11.0`](https://renovatebot.com/diffs/npm/morgan/1.10.1/1.11.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/morgan/1.11.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/morgan/1.10.1/1.11.0?slim=true)
|

---

### morgan vulnerable to Log Forging via unneutralized control
characters in :remote-user
[CVE-2026-5078](https://nvd.nist.gov/vuln/detail/CVE-2026-5078) /
[GHSA-4vj7-5mj6-jm8m](https://redirect.github.com/advisories/GHSA-4vj7-5mj6-jm8m)

<details>
<summary>More information</summary>

#### Details
##### Impact

Morgan's `:remote-user` token extracts the Basic auth username from the
`Authorization` header and writes it to the log stream without
neutralizing control characters. An attacker can send a crafted
`Authorization: Basic` header containing CR/LF characters to inject
forged log lines, corrupting the one-request-per-line structure of
access logs.

The built-in `combined`, `common`, `default`, and `short` formats are
affected, as well as any custom format that includes `:remote-user`.

##### Patches

Users should upgrade to version 1.11.0.

##### Workarounds

Use a custom format string that does not include `:remote-user`.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

#### References
-
[https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m](https://redirect.github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-5078](https://nvd.nist.gov/vuln/detail/CVE-2026-5078)
-
[https://cna.openjsf.org/security-advisories.html](https://cna... (continued)

537 of 4564 branches covered (11.77%)

Branch coverage included in aggregate %.

997 of 7041 relevant lines covered (14.16%)

2.17 hits per line