AIKIDO-2026-442728

TL;DR

Morgan is an HTTP request logger that writes token values such as the request URL, the User-Agent and Referrer headers, and the Basic authentication username into a line-oriented log stream. An earlier fix neutralized C0 control characters but left Unicode line separators such as NEL, LINE SEPARATOR, and PARAGRAPH SEPARATOR unescaped, and token values produced by custom format functions were not escaped. Because these separators are valid in ordinary HTTP requests and headers, externally influenced input can split one log record into several forged entries and inject terminal control sequences, corrupting log integrity. The fix escapes all string token output, including custom function output, and extends escaping to C1 control characters and the Unicode line separators.