{"uuid": "8ce1329f-7dfb-48ae-9046-b4448ac4d3d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9f6g-j8ch-79g4", "type": "seen", "source": "https://gist.github.com/alon710/6266e6c36342f7f1bd3c2768aedd88b9", "content": "# CVE-2026-87859: CVE-2026-87859: Log Injection Vulnerability in Morgan HTTP Request Logger\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87859\n\n## Summary\nCVE-2026-87859 is a medium-severity log injection vulnerability in the Node.js morgan HTTP request logger middleware. Prior to version 1.12.1, the internal sanitization utility fails to escape double-quote characters within logged fields, enabling unauthenticated remote attackers to inject arbitrary text, close log fields early, and spoof critical metadata in downstream log parsers.\n\n## TL;DR\nUnescaped double quotes in morgan log fields allow attackers to forge HTTP status codes and response metrics in access logs, blinding automated SIEM parsers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-117 (Improper Output Neutralization for Logs)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00393 (Percentile: 33.29%)\n- **Impact**: Low Integrity (Log Spoofing & Manipulation)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications utilizing morgan middleware for HTTP request logging\n- **morgan**: < 1.12.1 (Fixed in: `1.12.1`)\n\n## Mitigation\n\n- Upgrade the 'morgan' dependency to version 1.12.1 or higher.\n- Use custom log formats that avoid quoting user-controlled headers if upgrading is not immediately possible.\n- Implement log validation downstream to detect anomalous formatting structures.\n\n**Remediation Steps:**\n1. Locate all project instances using the 'morgan' library.\n2. Execute 'npm install morgan@1.12.1' or update 'package.json' and run 'npm install'.\n3. Verify the installation by checking package-lock.json to ensure no transitive dependencies are resolving to older versions.\n4. Deploy the updated application to production and verify that double quotes are successfully escaped in the generated log output.\n\n## References\n\n- [GitHub Security Advisory GHSA-9f6g-j8ch-79g4](https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4)\n- [Fix Commit in Morgan Repository](https://github.com/expressjs/morgan/commit/4b695edf967ce179cdf4009fe8cddd184b7511ee)\n- [Release Tag 1.12.1](https://github.com/expressjs/morgan/releases/tag/1.12.1)\n- [OpenJS Foundation Advisory Portal](https://cna.openjsf.org/security-advisories.html)\n- [NVD CVE-2026-87859 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-87859)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87859) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T02:31:24.000000Z"}