From ce9d820ee17a3c2f190ad866c95c6956684a622c Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Mon, 8 Jun 2026 11:38:36 +0200 Subject: [PATCH 1/4] blog: June 2026 security releases --- .../blog/2026-06-08-security-releases.mdx | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 src/content/blog/2026-06-08-security-releases.mdx diff --git a/src/content/blog/2026-06-08-security-releases.mdx b/src/content/blog/2026-06-08-security-releases.mdx new file mode 100644 index 0000000000..1b15335762 --- /dev/null +++ b/src/content/blog/2026-06-08-security-releases.mdx @@ -0,0 +1,41 @@ +--- +title: June 2026 Security Releases +description: Security releases for morgan have been published. We recommend that all users upgrade as soon as possible. +tags: ['security'] +authors: + - name: Ulises Gascon + github: UlisesGascon +--- + +import Alert from '@components/primitives/Alert/Alert.astro'; + +The Express team has released [morgan](https://www.npmjs.com/package/morgan) 1.11.0, addressing a log forging vulnerability in the `:remote-user` token. + + + +We recommend upgrading to the latest version of morgan to secure your applications. If you have a `package-lock.json`, you can update the dependency by running: + +```sh +npm update morgan +``` + + + +The following vulnerabilities have been addressed: + +- [CVE-2026-5078 in morgan middleware (Medium)](#cve-2026-5078-in-morgan-middleware-medium) + +## CVE-2026-5078 in morgan middleware (Medium) + +**[morgan](https://www.npmjs.com/package/morgan) versions `>= 1.2.0, <= 1.10.1` are vulnerable to log forging via unneutralized control characters in the `:remote-user` token** + +Morgan's `:remote-user` token writes the Basic auth username from the `Authorization` header to the log stream without neutralizing control characters. A crafted `Authorization: Basic` header containing CR/LF characters can inject forged log lines, corrupting the one-request-per-line structure of access logs. The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`. + +**Affected versions**: `>= 1.2.0, <= 1.10.1` +**Patched version**: `>= 1.11.0` + +For more details, see [GHSA-4vj7-5mj6-jm8m](https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m). + +--- + +We recommend upgrading to the latest version of morgan to secure your applications. From 5db5c4156afdf5c14dfaa63d8165d6401fc8a683 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Tue, 30 Jun 2026 12:26:56 +0200 Subject: [PATCH 2/4] blog: add multer CVE-2026-5079 + CVE-2026-5038 to June 2026 security releases --- ...-08-security-releases.mdx => 2026-06-30-security-releases.mdx} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename src/content/blog/{2026-06-08-security-releases.mdx => 2026-06-30-security-releases.mdx} (100%) diff --git a/src/content/blog/2026-06-08-security-releases.mdx b/src/content/blog/2026-06-30-security-releases.mdx similarity index 100% rename from src/content/blog/2026-06-08-security-releases.mdx rename to src/content/blog/2026-06-30-security-releases.mdx From 5cbe52caea6d6c67f8efd407524efe9366403c70 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Tue, 30 Jun 2026 12:27:50 +0200 Subject: [PATCH 3/4] blog: rewrite June 2026 post for multi-package (multer + morgan) --- .../blog/2026-06-30-security-releases.mdx | 36 +++++++++++++++---- 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/src/content/blog/2026-06-30-security-releases.mdx b/src/content/blog/2026-06-30-security-releases.mdx index 1b15335762..bb4c69c176 100644 --- a/src/content/blog/2026-06-30-security-releases.mdx +++ b/src/content/blog/2026-06-30-security-releases.mdx @@ -1,6 +1,6 @@ --- title: June 2026 Security Releases -description: Security releases for morgan have been published. We recommend that all users upgrade as soon as possible. +description: Security releases for multer and morgan have been published. We recommend that all users upgrade as soon as possible. tags: ['security'] authors: - name: Ulises Gascon @@ -9,25 +9,38 @@ authors: import Alert from '@components/primitives/Alert/Alert.astro'; -The Express team has released [morgan](https://www.npmjs.com/package/morgan) 1.11.0, addressing a log forging vulnerability in the `:remote-user` token. +The Express team has released [multer](https://www.npmjs.com/package/multer) 2.2.0 and [morgan](https://www.npmjs.com/package/morgan) 1.11.0, addressing three vulnerabilities across multipart parsing and access logging. -We recommend upgrading to the latest version of morgan to secure your applications. If you have a `package-lock.json`, you can update the dependency by running: +We recommend upgrading to the latest versions of multer and morgan to secure your applications. If you have a `package-lock.json`, you can update the dependencies by running: ```sh -npm update morgan +npm update multer morgan ``` The following vulnerabilities have been addressed: +- [CVE-2026-5079 in multer middleware (High)](#cve-2026-5079-in-multer-middleware-high) - [CVE-2026-5078 in morgan middleware (Medium)](#cve-2026-5078-in-morgan-middleware-medium) +- [CVE-2026-5038 in multer middleware (Medium)](#cve-2026-5038-in-multer-middleware-medium) + +## CVE-2026-5079 in multer middleware (High) + +**[multer](https://www.npmjs.com/package/multer) versions `>= 1.0.0, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2` are vulnerable to denial of service via deeply nested field names in multipart form data** + +Multer uses the `append-field` dependency to parse bracket notation in field names such as `a[b][c]`. There is no limit on nesting depth, so an attacker can send a multipart form with field names that force allocation of deeply nested objects. With sufficient nesting, request handling consumes excessive memory and CPU, causing denial of service. The vulnerability affects all consumers that pass user-controlled multipart forms through multer's parser. + +**Affected versions**: `>= 1.0.0, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2` +**Patched version**: `>= 2.2.0` (stable line) and `>= 3.0.0-alpha.2` (alpha line) + +For more details, see [GHSA-72gw-mp4g-v24j](https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j). ## CVE-2026-5078 in morgan middleware (Medium) -**[morgan](https://www.npmjs.com/package/morgan) versions `>= 1.2.0, <= 1.10.1` are vulnerable to log forging via unneutralized control characters in the `:remote-user` token** +**[morgan](https://www.npmjs.com/package/morgan) versions `>= 1.2.0, <= 1.10.1` are vulnerable to log forging via unsanitized control characters in the `:remote-user` token** Morgan's `:remote-user` token writes the Basic auth username from the `Authorization` header to the log stream without neutralizing control characters. A crafted `Authorization: Basic` header containing CR/LF characters can inject forged log lines, corrupting the one-request-per-line structure of access logs. The built-in `combined`, `common`, `default`, and `short` formats are affected, as well as any custom format that includes `:remote-user`. @@ -36,6 +49,17 @@ Morgan's `:remote-user` token writes the Basic auth username from the `Authoriza For more details, see [GHSA-4vj7-5mj6-jm8m](https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m). +## CVE-2026-5038 in multer middleware (Medium) + +**[multer](https://www.npmjs.com/package/multer) versions `>= 2.0.0-alpha.1, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2` are vulnerable to denial of service via incomplete cleanup of aborted uploads** + +When multer's `diskStorage` engine is used, aborted or malformed multipart uploads leave orphaned partial files on disk. The cleanup path does not run on every error condition, so an attacker can fill the upload directory by repeatedly opening and dropping connections mid-upload. Over time this exhausts disk space, causing denial of service on the host. + +**Affected versions**: `>= 2.0.0-alpha.1, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2` +**Patched version**: `>= 2.2.0` (stable line) and `>= 3.0.0-alpha.2` (alpha line) + +For more details, see [GHSA-3p4h-7m6x-2hcm](https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm). + --- -We recommend upgrading to the latest version of morgan to secure your applications. +We recommend upgrading to the latest versions of multer and morgan to secure your applications. From d1ceb49fb5660ff8835d20b9c5727a72ded191dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Tue, 30 Jun 2026 14:20:47 +0200 Subject: [PATCH 4/4] Update src/content/blog/2026-06-30-security-releases.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: krzysdz <12915102+krzysdz@users.noreply.github.com> Signed-off-by: Ulises Gascón --- src/content/blog/2026-06-30-security-releases.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/blog/2026-06-30-security-releases.mdx b/src/content/blog/2026-06-30-security-releases.mdx index bb4c69c176..370c7b7797 100644 --- a/src/content/blog/2026-06-30-security-releases.mdx +++ b/src/content/blog/2026-06-30-security-releases.mdx @@ -33,7 +33,7 @@ The following vulnerabilities have been addressed: Multer uses the `append-field` dependency to parse bracket notation in field names such as `a[b][c]`. There is no limit on nesting depth, so an attacker can send a multipart form with field names that force allocation of deeply nested objects. With sufficient nesting, request handling consumes excessive memory and CPU, causing denial of service. The vulnerability affects all consumers that pass user-controlled multipart forms through multer's parser. -**Affected versions**: `>= 1.0.0, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2` +**Affected versions**: `>= 1.0.0, < 2.2.0` and `>= 3.0.0-alpha.1, < 3.0.0-alpha.2`\ **Patched version**: `>= 2.2.0` (stable line) and `>= 3.0.0-alpha.2` (alpha line) For more details, see [GHSA-72gw-mp4g-v24j](https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j).