zwave-js / zwave-js-ui / 34436197843

13%

push

github

fix(deps): update dependency morgan to ~1.12.0 (#4822)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [morgan](https://redirect.github.com/expressjs/morgan) | [`~1.11.0` →
`~1.12.0`](https://renovatebot.com/diffs/npm/morgan/1.11.0/1.12.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/morgan/1.12.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/morgan/1.11.0/1.12.0?slim=true)
|

---

### morgan vulnerable to Log Forging via unescaped Unicode line
separators
[CVE-2026-15603](https://nvd.nist.gov/vuln/detail/CVE-2026-15603) /
[GHSA-jxfw-x594-9x9m](https://redirect.github.com/advisories/GHSA-jxfw-x594-9x9m)

<details>
<summary>More information</summary>

#### Details
##### Impact

Morgan writes attacker-controlled request data to the access log through
its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and
backslash, but it does not escape the Unicode line separators `U+0085`
(NEL), `U+2028` (LINE SEPARATOR), or `U+2029` (PARAGRAPH SEPARATOR).
These code points are reachable through several tokens, including the
request URL (`:url`), request headers such as `:user-agent` and
`:referrer`, arbitrary `:req[header]` values, and the Basic auth
username (`:remote-user`). NEL is valid `obs-text` in HTTP header
values, so an attacker can place it in an ordinary request header.

When such a value is logged, the raw code points survive into the
emitted access-log record, and downstream ECMAScript-aware or
Unicode-aware log processing splits the single physical record into
multiple logical records. This allows an attacker to forge log entries.
The built-in `combined`, `common`, `default`, and `short` formats are
affected, as well as any custom format. This is an incomplete fix of
CVE-2026-5078.

##### Patches

Users should upgrade to version 1.12.0.

##... (continued)

539 of 4566 branches covered (11.8%)

Branch coverage included in aggregate %.

1000 of 7044 relevant lines covered (14.2%)

2.2 hits per line