{"metadata": {"vulnerability": "CVE-2026-87859", "count": 25, "kinds": {"milestone": 11, "sighting": 3, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-09T13:05:45.895Z", "date_only": false, "value": "2026-09-09T13:05:45.895Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-87859", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-11T09:15:19.109Z", "date_only": false, "value": "2026-09-11T09:15:19.109Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87859", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-11T09:15:19.109Z", "date_only": false, "value": "2026-09-11T09:15:19.109Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-87859", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-11T09:21:21.195Z", "date_only": false, "value": "2026-09-11T09:21:21.195638Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mvaahpudgk2t", "record": "CVE-2026-87859", "field": "creation_timestamp", "uuid": "543ac499-61f3-40bd-aeda-465c49803323", "content": "\ud83d\udea8 Medium-severity security fix in morgan@1.12.1 just released!\n\nPatches CVE-2026-87859: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields\n\ngithub.com/expressjs/mo...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3mvaahpudgk2t"}, {"timestamp": "2026-09-11T10:16:00Z", "date_only": false, "value": "2026-09-11T10:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-87859", "record": "UBUNTU-CVE-2026-87859", "field": "published"}, {"timestamp": "2026-09-11T10:16:53Z", "date_only": false, "value": "2026-09-11T10:16:53Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9F6G-J8CH-79G4", "record": "GHSA-9F6G-J8CH-79G4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-11T10:16:53.253Z", "date_only": false, "value": "2026-09-11T10:16:53.253", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87859", "record": "FKIE_CVE-2026-87859", "field": "published"}, {"timestamp": "2026-09-11T11:22:20.073Z", "date_only": false, "value": "2026-09-11T11:22:20.073554Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87859", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-11T11:22:20.073Z", "date_only": false, "value": "2026-09-11T11:22:20.073554Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87859", "record": "FKIE_CVE-2026-87859", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-11T11:32:10.246Z", "date_only": false, "value": "2026-09-11T11:32:10.246Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-87859", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:32:10.246Z", "date_only": false, "value": "2026-09-11T11:32:10.246Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87859", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:51:57.498Z", "date_only": false, "value": "2026-09-11T11:51:57.498077Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gk3b4eixszvfv", "record": "CVE-2026-87859", "field": "creation_timestamp", "uuid": "c851746c-b9ef-4c96-8442-6adc6dd5fc5a", "content": "CVE-2026-87859 - morgan vulnerable to Log Injection via unescaped double quote in quoted log fields\nCVE ID : CVE-2026-87859\n \n Published : Sept. 11, 2026, 10:16 a.m. | 39\u00a0minutes ago\n \n Description : morgan is an HTTP request logger middleware for Node.js. In versions before 1...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/gk3b4eixszvfv"}, {"timestamp": "2026-09-16T19:40:00.317Z", "date_only": false, "value": "2026-09-16T19:40:00.317", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87859", "record": "FKIE_CVE-2026-87859", "field": "lastModified"}, {"timestamp": "2026-09-28T21:33:08Z", "date_only": false, "value": "2026-09-28T21:33:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9F6G-J8CH-79G4", "record": "GHSA-9F6G-J8CH-79G4", "field": "published"}, {"timestamp": "2026-09-28T21:33:08Z", "date_only": false, "value": "2026-09-28T21:33:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9F6G-J8CH-79G4", "record": "GHSA-9F6G-J8CH-79G4", "field": "modified"}, {"timestamp": "2026-09-29T02:31:24Z", "date_only": false, "value": "2026-09-29T02:31:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/6266e6c36342f7f1bd3c2768aedd88b9", "record": "CVE-2026-87859", "field": "creation_timestamp", "uuid": "277370b4-24fb-4cff-ab1d-209cbc751d9b", "content": "# CVE-2026-87859: CVE-2026-87859: Log Injection Vulnerability in Morgan HTTP Request Logger\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87859\n\n## Summary\nCVE-2026-87859 is a medium-severity log injection vulnerability in the Node.js morgan HTTP request logger middleware. Prior to version 1.12.1, the internal sanitization utility fails to escape double-quote characters within logged fields, enabling unauthenticated remote attackers to inject arbitrary text, close log fields early, and spoof critical metadata in downstream log parsers.\n\n## TL;DR\nUnescaped double quotes in morgan log fields allow attackers to forge HTTP status codes and response metrics in access logs, blinding automated SIEM parsers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-117 (Improper Output Neutralization for Logs)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00393 (Percentile: 33.29%)\n- **Impact**: Low Integrity (Log Spoofing & Manipulation)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications utilizing morgan middleware for HTTP request logging\n- **morgan**: < 1.12.1 (Fixed in: `1.12.1`)\n\n## Mitigation\n\n- Upgrade the 'morgan' dependency to version 1.12.1 or higher.\n- Use custom log formats that avoid quoting user-controlled headers if upgrading is not immediately possible.\n- Implement log validation downstream to detect anomalous formatting structures.\n\n**Remediation Steps:**\n1. Locate all project instances using the 'morgan' library.\n2. Execute 'npm install morgan@1.12.1' or update 'package.json' and run 'npm install'.\n3. Verify the installation by checking package-lock.json to ensure no transitive dependencies are resolving to older versions.\n4. Deploy the updated application to production and verify that double quotes are successfully escaped in the generated log output.\n\n## References\n\n- [GitHub Security Advisory GHSA-9f6g-j8ch-79g4](https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4)\n- [Fix Commit in Morgan Repository](https://github.com/expressjs/morgan/commit/4b695edf967ce179cdf4009fe8cddd184b7511ee)\n- [Release Tag 1.12.1](https://github.com/expressjs/morgan/releases/tag/1.12.1)\n- [OpenJS Foundation Advisory Portal](https://cna.openjsf.org/security-advisories.html)\n- [NVD CVE-2026-87859 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-87859)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87859) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/6266e6c36342f7f1bd3c2768aedd88b9"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": true, "value": "2026-10-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.3.published_at"}, {"timestamp": "2026-10-17T09:54:15Z", "date_only": false, "value": "2026-10-17T09:54:15Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-87859", "record": "UBUNTU-CVE-2026-87859", "field": "modified"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": true, "value": "2026-10-19", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.2.published_at"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.4.published_at"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "last_revision_date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "vendor_advisories.10.published_at"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1378", "record": "CERTFR-2026-AVI-1378", "field": "revisions.0.revision_date"}]}