Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87859— morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Quick assessment

Affected
morgan morgan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Morgan 是 Node.js 的 HTTP 请求日志记录中间件。在 1.12.1 之前的版本中，其 函数未转义双引号字符，而双引号是 Morgan 输出的 Apache 组合日志格式中用于界定带引号字段的分隔符。 若一个未认证的远程攻击者能够控制写入带引号字段的值（例如 User-Agent 或 Referer 请求头），则可以在其中插入一个双引号，从而提前结束该字段。这样，按照字段位置解析日志的日志消费者会将攻击者提供的文本误读为下一个字段。对于内置日志格式，这会导致记录的值与请求中实际发送的值不一致；对于自

CVSS 5.3 · Medium EPSS 0.39% · P33

Possible ATT&CK Techniques 1 AI

T1070.001

Affected Version Matrix 2

VendorProduct Version RangeStatus
morgan morgan < 1.12.1 affected
1.12.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87859

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
Source: CVE Program / CVE List V5
Vulnerability Description
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
日志输出的转义处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
morgan morgan 0 ~ 1.12.1 -

II. Public POCs for CVE-2026-87859

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87859

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-87859 (1)

IV. Related Vulnerabilities

Same product: morgan
Same vendor: morgan
Same weakness: CWE-117

V. Comments for CVE-2026-87859

No comments yet

Leave a comment