zwave-js / zwave-js-ui / 36542665559

13%

push

github

chore(deps): update dependency morgan to v1.12.1 (#4838)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [morgan](https://redirect.github.com/expressjs/morgan) | [`1.12.0` →
`1.12.1`](https://renovatebot.com/diffs/npm/morgan/1.12.0/1.12.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/morgan/1.12.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/morgan/1.12.0/1.12.1?slim=true)
|

---

### morgan vulnerable to Log Injection via unescaped double quote in
quoted log fields
[CVE-2026-87859](https://nvd.nist.gov/vuln/detail/CVE-2026-87859) /
[GHSA-9f6g-j8ch-79g4](https://redirect.github.com/advisories/GHSA-9f6g-j8ch-79g4)

<details>
<summary>More information</summary>

#### Details
##### Impact

Morgan writes attacker-controlled request data to the access log. Its
escaping (added in 1.11.0 and 1.12.0) neutralizes control characters,
the Unicode line separators, and backslash, but not the double quote
(`0x22`), which is the field delimiter of the Apache combined log format
morgan emits. An attacker who controls a quoted field (`:user-agent`,
`:referrer`, the request URL, or the Basic auth `:remote-user`) can
inject a double quote to close the field early and forge additional
fields in the log record. The `combined`, `common`, and `default`
formats, and any custom format that quotes a token, are affected. This
is an incomplete fix of CVE-2026-5078 and CVE-2026-15603.

##### Patches

Users should upgrade to version 1.12.1.

##### Workarounds

Update to version 1.12.1.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

#### References
-
[https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4](https://redirect.github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4)
-
[http... (continued)

537 of 4566 branches covered (11.76%)

Branch coverage included in aggregate %.

991 of 7044 relevant lines covered (14.07%)

2.2 hits per line