CVE-2026-87859 in morgan
Summary
by MITRE • 09/11/2026
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in Morgan versions prior to 1.12.1 represents a significant log injection flaw rooted in insufficient input sanitization within the escapeLogField function. As an HTTP request logger middleware for Node.js, Morgan is designed to capture and format incoming web traffic data into standardized logs, typically adhering to the Apache combined log format. This format relies heavily on double quotes to delimit specific fields such as the User-Agent or Referer headers. The core technical flaw lies in the failure of the escapeLogField function to properly escape the double quote character when processing these input values. Consequently, if an attacker controls a value that is written into one of these quoted fields, they can inject a raw double quote string. This injection allows the attacker to prematurely close the intended field delimiter, thereby breaking the structural integrity of the log entry from the perspective of any downstream parser that relies on fixed-field positions or simple splitting logic.
The operational impact of this vulnerability is primarily centered around log manipulation and potential data corruption within logging pipelines. Because no newline characters are injected by this specific flaw, record separation remains intact, preventing traditional Log Injection attacks that aim to create false log entries or obscure malicious activity through entry fragmentation. However, the ability to close a field early allows an unauthenticated remote attacker to shift subsequent content into adjacent fields. In standard built-in formats, this results in recorded values differing from their actual sent counterparts, leading to inaccurate audit trails and analytics data. More critically, in custom logging configurations where an attacker-controlled token is quoted immediately before a server-controlled value, such as the HTTP response status code, the injection can effectively forge these server-side values. This capability undermines the integrity of security monitoring systems that rely on accurate log parsing for threat detection and incident response.
From a classification perspective, this vulnerability aligns with CWE-117: Improper Output Neutralization for Logs, which describes flaws where an application fails to neutralize special characters in data before writing it to logs. Furthermore, the exploitation technique relates to ATT&CK Tactic TA0005 (Defense Evasion), specifically techniques involving Log Injection or Log Spoofing, as attackers may use this flaw to manipulate log contents for obfuscation purposes or to trigger false positives and negatives in security information and event management systems. The lack of proper escaping allows the attacker to bypass simple parsing assumptions made by downstream consumers of these logs, effectively poisoning the data source that many automated defense mechanisms depend upon.
To mitigate this vulnerability, organizations must upgrade Morgan to version 1.12.1 or later, where the escapeLogField function has been patched to correctly handle and escape double quote characters within input fields. This update ensures that special characters are neutralized before being written to log files, preserving the structural integrity of the Apache combined log format. In addition to upgrading dependencies, developers should implement defense-in-depth strategies by validating and sanitizing all user-supplied data at the application layer prior to logging. It is also advisable for organizations consuming these logs to employ robust parsing libraries that are resilient against malformed input rather than relying solely on simple string splitting based on delimiters. Regular auditing of log formats and parser configurations can further reduce the risk associated with such injection flaws, ensuring that security telemetry remains accurate and reliable.