CVE-2026-87859: morgan HTTP request logger log injection via unescaped double quote

CVE-2026-87859 · Severity: medium · CVSS 5.3 · Published 2026-09-11

morgan is a Node.js middleware that logs HTTP requests to access logs in Apache combined log format. An attacker can inject unescaped double quotes via request headers (User-Agent, Referer) or request URL to break out of quoted log fields, causing log parsers to misread field values. This can lead to log record forgery, especially if custom log formats quote attacker-controlled data before server-controlled fields like response status or byte counts, enabling attackers to forge values in access logs that automated security tools or log analyzers rely upon.

Technologies: morgan (npm). Vendors: npm.

Quick answers

Is CVE-2026-87859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87859 being exploited in the wild.
How severe is CVE-2026-87859?
Medium severity, with a CVSS score of 5.3, published 11 September 2026.
Which products and versions are affected?
morgan (npm) < 1.12.1, SEMVER:introduced=0,fixed=1.12.1.
Is there a fix for CVE-2026-87859?
Yes. morgan (npm): upgrade to 1.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87859 attacked?
It is attacked over the network.
Am I affected by CVE-2026-87859?
Check whether you run morgan (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • morgan (npm): upgrade to 1.12.1 or later
    npm install morgan@1.12.1

Technical details

morgan's escapeLogField() function fails to escape double quote characters (0x22) when writing HTTP request data to access logs in Apache combined log format. The vulnerability resides in quoted log fields such as :user-agent, :referrer, :req[...], and request-line. An unauthenticated remote attacker can include a double quote in these headers to prematurely close a quoted field, causing log parsers that rely on field-position parsing (e.g., Logstash grok, SIEM pipelines, log analytics tools) to read attacker-supplied text as the following positional field. In custom log formats that quote an attacker-controlled token before a server-controlled one, this allows forging values like response status or byte count. No newline injection occurs, preserving record separation. The fix in 1.12.1 adds escaping for the double quote character. This is an incomplete fix of prior CVE-2026-15603 and CVE-2026-5078.

Affected products

  • expressjs morgan before 1.12.1

Identifiers

  • CVE-2026-87859
  • GHSA-9f6g-j8ch-79g4

Timeline

  • 2026-09-11: disclosed
  • 2026-09-11: patched: morgan 1.12.1 released with double quote escaping

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.