HTTP Request Logger Middleware Vulnerability in Morgan by Express.js

CVE-2026-87859

What is CVE-2026-87859?

The Morgan middleware for Node.js, responsible for logging HTTP requests, contains a vulnerability in versions prior to 1.12.1. Specifically, the escapeLogField() function fails to escape the double quote character used in the Apache combined log format. This oversight allows an unauthenticated remote attacker to manipulate quoted fields, such as the User-Agent or Referer headers, resulting in incorrect log entries. By injecting a double quote, an attacker can mislead log consumers by closing a field early, leading to the interpretation of malicious data as legitimate information. The issue has been addressed in Morgan version 1.12.1, which includes the necessary fix to escape the double quote character effectively. Users are advised to update to this version or later to mitigate potential exploitation.

References