CVE-2026-87859: morgan Node.js Middleware XSS Vulnerability

CVE-2026-87859 Overview

CVE-2026-87859 is a log injection vulnerability [CWE-117] in morgan, an HTTP request logger middleware for Node.js maintained under the Express.js project. The escapeLogField() function in versions before 1.12.1 fails to escape the double quote character. Attackers can inject a double quote into any request header that morgan writes into a quoted log field, prematurely closing that field. Downstream log consumers that parse the Apache combined log format by field position then read attacker-supplied text as adjacent fields, including server-controlled values like the HTTP response status.

Critical Impact
An unauthenticated remote attacker can forge log field values, such as a response status code, by injecting a double quote into a header like User-Agent or Referer.

Affected Products

morgan (npm package) versions prior to 1.12.1
Node.js applications using morgan with the built-in combined, common, or custom quoted-token formats
Log pipelines that parse morgan output by field position (SIEM, log shippers, analytics tools)

Discovery Timeline

2026-09-11 - CVE-2026-87859 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87859

Vulnerability Analysis

The issue stems from incomplete output sanitization in morgan's escapeLogField() helper. The Apache combined log format delimits several fields with double quote characters. When morgan records a value such as the User-Agent or Referer header inside those quoted fields, the helper escapes control characters but not the double quote itself.

An attacker who controls one of those header values can send a raw " byte. This closes the quoted field early from the perspective of any log parser that splits records by field position. The remaining attacker-supplied bytes are then interpreted as the next field in the record.

In morgan's built-in formats this causes the logged value to diverge from the value actually sent. In custom formats where an attacker-controlled token is emitted immediately before a server-controlled token such as :status, an attacker can forge the server-controlled value. Record separation is preserved because no newline is injected, so the corruption is bounded to individual log lines and is easy to overlook.

Root Cause

The escapeLogField() function in morgan versions prior to 1.12.1 does not include the double quote character in its escape set. This is a classic CWE-117 improper output neutralization for logs.

Attack Vector

Exploitation requires only an unauthenticated HTTP request. The attacker sets a header such as User-Agent: Mozilla/5.0" 200 0 "-" "attacker and sends it to any endpoint served by an application using vulnerable morgan. See the GitHub Security Advisory GHSA-9f6g-j8ch-79g4 for the vendor description.

No exploit code is required beyond crafting a header value. The impact depends on how log consumers parse the output and what security decisions they make based on parsed fields.

Detection Methods for CVE-2026-87859

Indicators of Compromise

Log lines where the User-Agent, Referer, or other quoted field contains an unescaped " character in the middle of the value
Discrepancies between the HTTP response status observed at the server or load balancer and the status recorded in application logs
Log records where field counts do not match the expected schema for the combined or common format

Detection Strategies

Run a software composition analysis scan across Node.js projects to identify any package-lock.json or yarn.lock entries referencing morgan at a version below 1.12.1
Compare access logs from morgan against an independent source such as a reverse proxy or WAF and alert on status code mismatches
Parse historical logs and flag any record where a quoted field contains a bare double quote followed by whitespace and additional tokens

Monitoring Recommendations

Ingest morgan output into a centralized log platform and add a validator rule that rejects or flags records with malformed quoted fields
Track outbound telemetry from log aggregation pipelines for anomalous field distributions after ingesting historical data
Monitor package registries for updates to morgan and other Express.js middleware for follow-on advisories

How to Mitigate CVE-2026-87859

Immediate Actions Required

Upgrade morgan to version 1.12.1 or later in all Node.js applications
Audit custom log formats that place attacker-controlled tokens adjacent to server-controlled tokens and reorder them where possible
Re-parse recent access logs to detect prior injection attempts and verify recorded status codes against upstream sources

Patch Information

The fix is included in morgan 1.12.1, which extends escapeLogField() to escape the double quote character. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-9f6g-j8ch-79g4 for advisory metadata and the upstream commit.

Workarounds

If immediate upgrade is not possible, wrap header values in a custom token that strips or replaces the " character before morgan formats them
Switch to a structured log format such as JSON where field boundaries do not rely on quote characters
Configure downstream log parsers to reject records whose field count differs from the expected schema rather than silently reassembling them

bash

# Upgrade morgan to the patched release
npm install morgan@^1.12.1

# Verify the resolved version in the lockfile
npm ls morgan