CVE-2026-87859: 
Node.js vulnerability analysis and mitigation

CVE-2026-87859 is a log injection vulnerability in morgan, an HTTP request logger middleware for Node.js, caused by the escapeLogField() function failing to escape the double quote character ("). All versions of morgan before 1.12.1 are affected. An unauthenticated remote attacker who controls a value written to a quoted log field (e.g., User-Agent or Referer headers) can inject a double quote to close that field early, causing log consumers that parse by field position to misread subsequent fields. The vulnerability was disclosed on September 11, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-117 (Improper Output Neutralization for Logs). Morgan's escapeLogField() function, introduced and expanded in versions 1.11.0 and 1.12.0 to neutralize control characters, Unicode line separators, and backslashes, omitted the double quote character (0x22), which serves as the field delimiter in the Apache Combined Log Format. An attacker crafts an HTTP request with a malicious User-Agent, Referer, or other header value containing a double quote, which terminates the quoted field prematurely in the emitted log line. Log consumers such as Logstash/grok, SIEM pipelines, or custom regex parsers that rely on field position then interpret attacker-supplied text as the next positional field. In custom log formats where an attacker-controlled token is quoted before a server-controlled one (e.g., :remote-addr ":referrer" :status), the attacker can forge server-controlled values such as the HTTP response status code. This vulnerability is described as an incomplete fix of CVE-2026-5078 and CVE-2026-15603 (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to manipulate how log consumers interpret access log records, compromising log integrity for forensic analysis, compliance auditing, and security monitoring. In built-in log formats, the primary effect is evasion — the recorded value differs from the value actually sent, potentially hiding attacker activity. In custom log formats that place attacker-controlled tokens before server-controlled ones in quoted fields, the attacker can forge values such as the HTTP response status code or byte count. There is no confidentiality or availability impact, and no newline injection occurs, so record separation remains intact (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is automatable (no user interaction or privileges required), but its technical impact is rated as partial. The EPSS score is approximately 0.31%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a Node.js application using morgan middleware (versions < 1.12.1) with a log format that places attacker-controlled fields (e.g., User-Agent, Referer) in quoted positions, particularly custom formats where a server-controlled field follows an attacker-controlled quoted field.
2. Craft malicious HTTP request: Construct an HTTP request with a header value containing a double quote to close the quoted field early, followed by a forged value for the next positional field. For example, set the Referer header to: http://evil.com" 200 1234 "FakeUserAgent to inject a forged status code and byte count.
3. Send the request: Deliver the crafted request to the target server. Morgan logs the raw header value without escaping the double quote, producing a malformed log line.
4. Log consumer parses forged fields: A log consumer (e.g., Logstash with the COMBINEDAPACHELOG grok pattern, a SIEM, or a custom parser) reads the log line by field position and interprets the attacker-supplied text as the subsequent server-controlled field (e.g., HTTP status code), effectively forging the logged value.
5. Achieve objective: The forged log entry misleads security analysts, evades detection, or corrupts compliance records by making malicious requests appear benign or altering recorded response codes (GitHub Advisory).

• Network: HTTP requests with User-Agent, Referer, or other header values containing unescaped double quote characters (") directed at Node.js applications using morgan.
• Logs: Access log lines in Apache Combined Log Format where quoted fields appear to close prematurely — e.g., a Referer or User-Agent field containing " followed by unexpected text that does not match the actual header value sent; log lines where the recorded HTTP status code or byte count does not match server-side records.
• Log Parsing Alerts: SIEM or log analytics pipeline parse errors or unexpected field value mismatches in morgan-generated access logs, particularly in Logstash grok patterns using COMBINEDAPACHELOG.

Users should upgrade morgan to version 1.12.1 or later, which escapes the double quote character in the escapeLogField() function (GitHub Advisory). As a workaround for those unable to upgrade immediately, switch to a log format that does not wrap attacker-controlled data in quoted fields — for example, the tiny or dev built-in formats, which contain no quoted fields. Additionally, ensure that log consumers do not parse morgan access log records strictly by field position, or add a validation/sanitization layer in the log ingestion pipeline to reject or escape records containing unexpected double quotes in field values (Red Hat Bugzilla).

The vulnerability was published by UlisesGascon under the OpenJS Foundation CNA on September 11, 2026, with credit to researcher iRevivalx for discovery (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it medium priority/severity (Red Hat Bugzilla). Tenable published a Nessus detection plugin (ID 344722) shortly after disclosure. General community reaction has been limited given the moderate severity and lack of active exploitation.