morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField()
    function does not escape the double quote character, which delimits the quoted fields of the Apache
    combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to
    a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field
    early, so a log consumer that parses the log by field position reads attacker-supplied text as the
    following field. In the built-in formats this makes the recorded value differ from the value that was
    sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can
    forge values such as the response status. No newline is injected, so record separation stays intact. The
    issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or
    later. (CVE-2026-87859)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField()     function does not escape the double quote character, which delimits the quoted fields of the Apache     combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to     a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field     early, so a log consumer that parses the log by field position reads attacker-supplied text as the     following field. In the built-in formats this makes the recorded value differ from the value that was     sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can     forge values such as the response status. No newline is injected, so record separation stays intact. The     issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or     later. (CVE-2026-87859)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448457	SCA: security update for morgan (GHSA-9f6g-j8ch-79g4)	Tenable Cloud Security	SCA Checks	Local	medium
448457	SCA: security update for morgan (GHSA-9f6g-j8ch-79g4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
344722	Linux Distros Unpatched Vulnerability : CVE-2026-87859	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-87859

medium

Tenable Plugins

medium

medium

medium