GitHub Advisoryadvisory · npm

GHSA-9f6g-j8ch-79g4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

MEDIUM Published 2026-09-28 Modified 2026-09-28 Official page ↗
Aliases
CVE-2026-87859
Ecosystem
npm
Packages
morgan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-117
Reviewed
2026-09-28

Affected packages

• npm morgan: < 1.12.1 → fixed in 1.12.1

Description

Impact Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0) neutralizes control characters, the Unicode line separators, and backslash, but not the double quote (`0x22`), which is the field delimiter of the Apache combined log format morgan emits. An attacker who controls a quoted field (`:user-agent`, `:referrer`, the request URL, or the Basic auth `:remote-user`) can inject a double quote to close the field early and forge additional fields in the log record. The `combined`, `common`, and `default` formats, and any custom format that quotes a token, are affected. This is an incomplete fix of CVE-2026-5078 and CVE-2026-15603. Patches Users should upgrade to version 1.12.1. Workarounds Update to version 1.12.1.

Related

Alias · CVE (1)

  • CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. vulnerability

Weakness · CWE (1)

  • CWE-117 Improper Output Neutralization for Logs weakness

References