{"answers":{"affected":"2 open source packages ship an affected version, including morgan.","exploited":"There is no known exploitation of CVE-2026-87859 in the wild and no public exploit code.","fix":"Upgrade morgan to 1.12.1 or later.","what":"CVE-2026-87859 is a medium-severity vulnerability in morgan, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-87859 and fix it if it is affected.\n\nWhat it is: CVE-2026-87859 is a medium-severity vulnerability in morgan, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-87859 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- morgan (npm): affected all versions; fixed in 1.12.1\n- morgan (npm): affected all versions; fixed in 1.12.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-87859/ (Markdown: https://insights.sbomify.com/CVE-2026-87859/index.md)","id":"CVE-2026-87859","markdown":"https://insights.sbomify.com/CVE-2026-87859/index.md","name":"CVE-2026-87859","record":{"aliases":["CLSA-2026-1790673247","CLSA-2026-1790676372","DEBIAN-CVE-2026-87859","GHSA-9f6g-j8ch-79g4","MINI-fgm7-5258-442c","MINI-q579-j3q4-f7ph","UBUNTU-CVE-2026-87859"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_modify","other"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js logging middleware","requires_auth":"none","summary":"Attackers can inject double quotes into HTTP headers to corrupt log field parsing, potentially forging log entries like response status codes.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openjs","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-117","name":"Improper Output Neutralization for Logs"}],"description":"morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"morgan vulnerable to Log Injection via unescaped double quote in quoted log fields","id":"CVE-2026-87859","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"other","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"Subscriptions for WooCommerce \u003c 2.0.3 - Subscription Cancellation via CSRF","id":"CVE-2026-87860"},"packages":[{"ecosystem":"npm","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"morgan","purl":null,"source":"GHSA-9f6g-j8ch-79g4"},{"ecosystem":"npm","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"morgan","purl":"pkg:npm/morgan","source":"GHSA-9f6g-j8ch-79g4"}],"prev":{"headline":"Missing authorization in Temporal Server","id":"CVE-2026-87858"},"products":["morgan"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-11","vendors":["morgan"]},"summary":"Attackers can inject double quotes into HTTP headers to corrupt log field parsing, potentially forging log entries like response status codes.","url":"https://insights.sbomify.com/CVE-2026-87859/"}