CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
Attackers can inject double quotes into HTTP headers to corrupt log field parsing, potentially forging log entries like response status codes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87859?
CVE-2026-87859 is a medium-severity vulnerability in morgan, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.
Weakness: CWE-117
Which versions are affected by CVE-2026-87859?
2 open source packages ship an affected version, including morgan.
| Package | Affected | Fixed in |
|---|---|---|
morgan npm | All versions | 1.12.1 |
morgan npm | All versions | 1.12.1 |
How do I fix CVE-2026-87859?
Upgrade morgan to 1.12.1 or later.
Is CVE-2026-87859 being exploited?
There is no known exploitation of CVE-2026-87859 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1790673247, CLSA-2026-1790676372, DEBIAN-CVE-2026-87859, GHSA-9f6g-j8ch-79g4, MINI-fgm7-5258-442c, MINI-q579-j3q4-f7ph and 1 more.