CVE-2026-87859

What it actually does

morgan versions before 1.12.1 fail to escape the double-quote character in escapeLogField() when emitting Apache combined/common-style quoted fields. An attacker-controlled value written into a quoted field (commonly User-Agent or Referer, or any custom quoted token) can close that field early. Parsers that split the line by field position then treat attacker-supplied text as later fields. Default formats cause the recorded header value to differ from what was sent; custom formats that quote an attacker-controlled token immediately before a server-controlled token can make subsequent fields such as response status appear forged. Newlines are not injected, so log-record boundaries remain intact. Impact is integrity of log field contents only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Why it matters to the business

Access logs, SIEM correlation, and post-incident reconstructions can be unreliable: recorded User-Agent/Referer values may not match the request, and in some custom formats the logged status or similar server-side fields can be made to look different from reality. That weakens investigations, fraud/abuse analytics, and compliance evidence without taking the application down. The issue is unauthenticated and network-reachable, but EPSS is low and flat (0.0041 over 30 days), exploit maturity is none, it is not on CISA KEV, and there is no reported ransomware or named-actor use about 29 days after publication. Residual risk is highest where morgan logs are treated as authoritative input to automated alerting or audit reporting.

How an attack unfolds

An unauthenticated remote client sends an HTTP request whose User-Agent, Referer, or other value that morgan writes into a quoted log field contains a raw double quote. morgan emits a single combined-format line without escaping that quote, so the quoted field ends early. A downstream consumer that parses by positional fields (common log shippers, SIEM grok/dissect rules, or scripts) assigns the remainder of the attacker-controlled string to later columns. In built-in formats this mainly desynchronizes stored request metadata from the actual headers. In custom formats that quote an attacker-influenced token before a server-controlled token, the attacker can make the log show forged values such as response status. No extra log line is created. No public exploit tooling or named campaigns are associated with this CVE at this time.

How to fix it

Upgrade morgan to 1.12.1 or later in every Node.js application; 1.12.1 escapes double quotes in escapeLogField(). Rebuild and redeploy so lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) resolve morgan >= 1.12.1, including transitive copies. If an immediate upgrade is blocked, stop quoting attacker-controlled tokens in custom format strings, prefer structured JSON logging, and treat quoted combined-format fields as untrusted until patched. Do not rely on WAF header stripping as a complete fix, because any remaining quoted attacker-controlled token can still break field boundaries.

How to confirm the fix worked

Confirm installed and lockfile versions of morgan are 1.12.1 or later (npm ls morgan / equivalent). After upgrade, issue a request whose User-Agent or Referer contains a double quote and verify the emitted line still has the correct number of quoted fields and that the quote is escaped rather than closing the field. Review custom morgan format strings for quoted tokens derived from request headers placed before server-controlled tokens. Spot-check SIEM grok/dissect rules against sample combined-format lines to ensure they do not silently accept shifted columns.

Typical attack path

1. Find a Node.js HTTP service that logs with morgan using combined, common, or a custom format that quotes attacker-influenced request data.
2. Send an unauthenticated HTTP request that places a double-quote character in User-Agent, Referer, or another quoted token.
3. Cause morgan to write one well-formed (newline-terminated) log line whose quoted field closes early.
4. Rely on a positional parser (SIEM, log pipeline, or script) to shift subsequent fields.
5. Optionally use a custom format that quotes attacker input before server-controlled tokens so those tokens are misread (for example recorded status).
6. Use the polluted record to mislead operators or automated detections that trust those fields.

How to detect it

Hunt historical morgan/Apache combined-format access logs (typically process stdout, container logs, or files written by the Node.js service) from before the upgrade. Look for single-line records with an extra unescaped double quote inside User-Agent or Referer that causes later columns (status, bytes, referer) to fail normal type checks—for example a non-three-digit status field. Compare logged status codes against independent application metrics or reverse-proxy logs for the same timestamp and client. Review SIEM parse-failure or dissect-mismatch events around HTTP access logs. There are no public exploits, malware families, or named threat actors to key on; evidence of abuse is malformed field layout rather than a distinctive implant. Absence of such lines does not prove non-exploitation if logs were rotated or parsers dropped unparseable records.

• combined-format access log lines whose User-Agent or Referer quoted field contains a raw " that is not escaped as \"
• positional combined-log parse failures where the status column is not a 3-digit HTTP code
• single log lines with an odd number of unescaped double-quote characters in quoted header fields
• mismatch between morgan-logged status and reverse-proxy or application status for the same request
• custom morgan format output where a quoted attacker-controlled token is immediately followed by text that resembles status or byte-count fields

What your security team should do

• Inventory all Node.js services and lockfiles for morgan < 1.12.1, including transitive dependencies, and upgrade to 1.12.1 or later.
• Prioritize internet-facing apps whose morgan output is ingested into SIEM, audit, or automated response pipelines.
• Prefer JSON or other structured logging so delimiter injection cannot shift columns.
• Until patched, treat User-Agent, Referer, and any custom quoted morgan fields as untrusted for status, size, or identity decisions.
• Tune log parsers to reject or alert on combined-format lines with unexpected extra quotes or non-numeric status columns.
• There is no KEV deadline or ransomware association; still patch on the normal cycle given unauthenticated reachability.