{"schema":"threatline.record/2","record":{"id":"CVE-2026-87859","aliases":["GHSA-9f6g-j8ch-79g4"],"summary":"morgan vulnerable to Log Injection via unescaped double quote in quoted log fields","details":"### Impact\n\nMorgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0) neutralizes control characters, the Unicode line separators, and backslash, but not the double quote (`0x22`), which is the field delimiter of the Apache combined log format morgan emits. An attacker who controls a quoted field (`:user-agent`, `:referrer`, the request URL, or the Basic auth `:remote-user`) can inject a double quote to close the field early and forge additional fields in the log record. The `combined`, `common`, and `default` formats, and any custom format that quotes a token, are affected. This is an incomplete fix of CVE-2026-5078 and CVE-2026-15603.\n\n### Patches\n\nUsers should upgrade to version 1.12.1.\n\n### Workarounds\n\nUpdate to version 1.12.1.","categories":["Libraries & packages"],"product":"morgan","vendor":"morgan","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9f6g-j8ch-79g4","source_modified_at":"2026-09-28T21:33:10Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"morgan"},"range":"< 1.12.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87859","source_modified_at":"2026-09-11T11:32:10.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"morgan","vendor":"morgan","versions":[{"versionType":"semver","status":"affected","version":"0","lessThan":"1.12.1"},{"versionType":"semver","status":"unaffected","version":"1.12.1"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9f6g-j8ch-79g4","source_modified_at":"2026-09-28T21:45:03.858040877Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"morgan","purl":"pkg:npm/morgan"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.12.1"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9f6g-j8ch-79g4","source_modified_at":"2026-09-28T21:33:10Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"morgan"},"version":"1.12.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-87859","source_modified_at":"2026-09-11T11:32:10.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"morgan","ecosystem":null},"version":"1.12.1","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9f6g-j8ch-79g4","source_modified_at":"2026-09-28T21:45:03.858040877Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"morgan","purl":"pkg:npm/morgan"},"version":"1.12.1"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0041,"percentile":0.34169,"score_date":"2026-10-23"},"published_at":"2026-09-11T09:15:19.109Z","modified_at":"2026-09-28T21:45:03.858040877Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9f6g-j8ch-79g4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T21:33:10Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-87859","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-11T11:32:10.246Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9f6g-j8ch-79g4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T21:45:03.858040877Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87859","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87859","source":"GitHub Advisory Database"},{"url":"https://github.com/expressjs/morgan/commit/4b695edf967ce179cdf4009fe8cddd184b7511ee","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/morgan/releases/tag/1.12.1","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-9f6g-j8ch-79g4","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-11T11:22:20.073554Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-28T21:45:03.858040877Z","content_hash":"296750902aaab458e89c10ec76a0ad144ced8cae41542c208c98c3093a794964"}}