CVE-2026-87859

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.1

Description The escapeLogField() function fails to escape the double quote character used to delimit quoted fields in the Apache combined log format. An unauthenticated remote attacker can exploit this by injecting a double quote into values written to quoted fields, such as the User-Agent or Referer headers. This allows the attacker to close a field prematurely, causing log consumers that parse by field position to interpret attacker-supplied text as subsequent fields. In built-in formats, this results in recorded values differing from the actual sent values, and in custom formats, it can be used to forge server-controlled values like the response status. Record separation remains intact as no newlines are injected.

Recommendations Update to version 1.12.1 or later.