The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField()     function does not escape the double quote character, which delimits the quoted fields of the Apache     combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to     a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field     early, so a log consumer that parses the log by field position reads attacker-supplied text as the     following field. In the built-in formats this makes the recorded value differ from the value that was     sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can     forge values such as the response status. No newline is injected, so record separation stays intact. The     issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or     later. (CVE-2026-87859)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-87859

medium Nessus Plugin ID 344722

Version 1.2

Version 1.1

Version 1.2 Sep 12, 2026, 3:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609120333
Version 1.1 Sep 11, 2026, 4:27 PM New Plugin Feed: 202609111627