morgan_project CVEs

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutraliz…

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.