morgan is an HTTP request logger middleware for Node.js.

CVE-2026-87859 affects morgan, the popular Node.js HTTP request logger (~13 million weekly npm downloads). In versions prior to 1.12.1, the escapeLogField() helper does not escape the double-quote character ("). Because morgan's built-in Apache combined log format uses double quotes to delimit fields like User-Agent and Referer, an unauthenticated remote attacker can inject a " into a header value they control. A downstream log parser that splits by field position will then read attacker-supplied text as a different field — for example, a crafted User-Agent could make the recorded HTTP status appear to be something it wasn't. Crucially, no newline injection is possible, so log-record boundaries remain intact.

The vendor scored this MEDIUM 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). That score is generous. The integrity impact is real but extremely narrow: it affects only log *parsing accuracy*, not application behaviour, data confidentiality, or availability. The attack cannot execute code, escalate privileges, or exfiltrate data. It is the third in a rapid-fire sequence of morgan log-injection CVEs (CVE-2026-5078 for CR/LF, CVE-2026-15603 for Unicode line separators, now this for double quotes), which suggests the escape function was simply incomplete rather than evidence of a deep architectural flaw. Downgrading to LOW is appropriate.

Why this verdict

• Impact ceiling is log cosmetics, not security: The worst-case outcome is a shifted column in a parsed log line. No code execution, no privilege escalation, no confidentiality breach, no availability degradation. This is categorically less severe than I:L typically implies.
• No record injection: Unlike CVE-2026-5078 (CR/LF) or CVE-2026-15603 (Unicode line separators), this CVE cannot create *new* log records. The attacker can only confuse field boundaries within a single existing line. This dramatically limits the ability to hide malicious activity or trigger false-positive alerts.
• Friction from structured logging adoption: A large fraction of production Node.js deployments have moved to structured/JSON logging (pino, winston, Datadog/OpenTelemetry exporters). Morgan is often used only in development or alongside structured loggers. Positional Apache-format parsing at the SIEM layer is increasingly uncommon, further narrowing real-world impact.
• Role multiplier: Morgan is an *application-layer logging middleware*, not infrastructure software. Even if a Node.js app runs in a high-value role (e.g., an API gateway, a CI webhook handler, an IdP frontend), exploiting this CVE in that context still only affects log accuracy — it does not grant the attacker any access to the application's data, identity store, or control plane. The blast radius is log-consumer-local regardless of deployment role, so no high-value-role floor applies.
• EPSS confirms low real-world priority: At 0.00309, this sits in the bottom third of all scored CVEs, consistent with a nuisance-grade finding.

Why not higher?

To reach MEDIUM the vulnerability would need to enable at least one of: new-record injection (enabling log-based evasion), downstream code execution via log parsing, or a path to data access. None of these apply. The double-quote escape gap cannot create new log lines, cannot trigger downstream injection in any known SIEM, and grants no application-level access. The attack is also fully mitigated by the increasingly common practice of structured JSON logging.

Why not lower?

IGNORE would be appropriate if the vulnerability had no security relevance at all. While the impact is marginal, log integrity does matter for forensic investigation and compliance audit trails. A determined attacker *could* use field-shifting to obscure indicators during an incident, making post-breach analysis harder. That residual investigative-integrity risk keeps it above IGNORE.

1. Switch to structured/JSON logging — If your Node.js apps use morgan's Apache-format output and feed it to a SIEM via positional parsing, switch to a JSON-structured logger (pino, winston, or morgan's custom format emitting JSON). This eliminates the entire class of field-delimiter injection. No mitigation SLA applies at LOW severity — treat as backlog hygiene.
2. Sanitize inbound headers at the reverse proxy — Strip or encode double-quote characters in User-Agent, Referer, and other logged headers at your edge proxy (nginx proxy_set_header, Envoy Lua filter, or AWS ALB request header rule). This neutralises the injection before it reaches morgan.
3. Upgrade morgan to 1.12.1 — The definitive fix. Run npm audit fix or npm install morgan@1.12.1 across affected repos. At LOW severity the noisgate remediation SLA is backlog-priority (no hard deadline), but since it is a one-line dependency bump with no breaking changes, there is little reason to delay.

Run on any host with node and npm installed. From the project root of a Node.js application that depends on morgan, execute: bash check_morgan_cve_2026_87859.sh. No special privileges required.

#!/usr/bin/env bash
# check_morgan_cve_2026_87859.sh
# Checks whether the installed morgan version is vulnerable to CVE-2026-87859
# (double-quote log field injection, fixed in 1.12.1)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

REQUIRED="1.12.1"

# Try to get installed morgan version
if command -v npm &>/dev/null; then
  INSTALLED=$(npm ls morgan --json 2>/dev/null | node -e "
    const fs = require('fs');
    const d = JSON.parse(fs.readFileSync('/dev/stdin','utf8'));
    function find(obj) {
      if (!obj || !obj.dependencies) return null;
      if (obj.dependencies.morgan) return obj.dependencies.morgan.version;
      for (const k of Object.keys(obj.dependencies)) {
        const r = find(obj.dependencies[k]);
        if (r) return r;
      }
      return null;
    }
    const v = find(d);
    if (v) process.stdout.write(v);
    else process.exit(1);
  " 2>/dev/null) || true
fi

if [ -z "${INSTALLED:-}" ]; then
  echo "UNKNOWN — morgan not found in this project's dependency tree."
  exit 2
fi

# Compare versions using node semver logic
RESULT=$(node -e "
  const inst = '${INSTALLED}'.split('.').map(Number);
  const req  = '${REQUIRED}'.split('.').map(Number);
  for (let i = 0; i < 3; i++) {
    if (inst[i] < req[i]) { console.log('VULNERABLE'); process.exit(0); }
    if (inst[i] > req[i]) { console.log('PATCHED');     process.exit(0); }
  }
  console.log('PATCHED');
")

echo "${RESULT} — morgan ${INSTALLED} installed (fix is ${REQUIRED}+)"
if [ "$RESULT" = "VULNERABLE" ]; then exit 1; fi
exit 0

Sources

1. OpenCVE — CVE-2026-87859
2. VulDB — CVE-2026-87859
3. TheHackerWire — CVE-2026-87859
4. DailyCVE — morgan log injection incomplete fix
5. npm — morgan package
6. Snyk — morgan security advisories