morgan@1.4.1 vulnerabilities

HTTP request logger middleware for node.js

Direct Vulnerabilities

Known vulnerabilities in the morgan package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Arbitrary Code Injection

morgan is a HTTP request logger middleware for node.js.

Affected versions of this package are vulnerable to Arbitrary Code Injection. An attacker could use the format parameter to inject arbitrary commands.

How to fix Arbitrary Code Injection?

Upgrade morgan to version 1.9.1 or higher.

<1.9.1