Description

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T10:16:53.253Z",
  "pubdate": "2026-09-11T10:16:53.253Z",
  "executiveSummary": "Morgan, a widely used Node.js HTTP request logger, contains a log injection vulnerability due to improper input sanitization in its escapeLogField() function. This flaw, present in versions prior to 1.12.1, permits an unauthenticated remote attacker to manipulate log file structures by injecting double-quote characters into request headers such as User-Agent or Referer.\nBy escaping the intended boundaries of quoted log fields, an attacker can break the structure of the Apache combined log format. This allows for the injection of arbitrary data into subsequent log fields, potentially misleading log analysis tools, security monitoring systems, or SIEM platforms. The impact ranges from log forgery to the potential manipulation of downstream security automated responses that rely on parsed log data.\nExploitation requires no authentication, as the attacker merely needs to send a crafted HTTP request to a server utilizing a vulnerable version of Morgan. Because Morgan does not strip newlines, the integrity of individual record separation is maintained; however, the internal consistency of the logged fields is compromised. Users are advised to upgrade to Morgan 1.12.1 or later to remediate the vulnerability.",
  "technicalDetails": "The vulnerability resides within the escapeLogField() function, which is responsible for sanitizing data before it is written to the log output in the Apache combined log format. The root cause is the failure to escape the double-quote (\") character. In the standard combined log format, certain fields are wrapped in double quotes to preserve their integrity. Because the function fails to sanitize or escape these delimiters, an attacker can supply a malicious payload containing a double-quote character within request headers.\nThe attack flow begins when an attacker sends an HTTP request with a crafted header—typically User-Agent or Referer—containing a double-quote character. For example, a User-Agent string crafted as 'Mozilla/5.0\" 404 0 \"' effectively terminates the first quoted field prematurely. When the logging middleware processes this input, the injected double-quote acts as a closing delimiter for the field. Consequently, the remaining portion of the attacker's input is pushed into subsequent fields defined by the log format string.\nIn scenarios utilizing custom log formats where an attacker-controlled token precedes a server-controlled one, this vulnerability allows for the forgery of log entries. For instance, an attacker could manipulate the log to misrepresent the HTTP response status or other metadata stored in later fields. This manipulation is particularly dangerous for log consumers and automated parsing engines that rely on fixed field positions or predictable delimiters to make security decisions, such as triggering an intrusion detection system (IDS) alert or an automated firewall block.\nThis vulnerability is restricted to environments using Morgan versions before 1.12.1. The flaw is not a newline injection attack; therefore, log separation (the actual record-to-record boundaries) remains intact, preventing the creation of completely arbitrary log entries. However, the data within the fields themselves is compromised, leading to issues with data integrity, log forensic analysis, and the reliability of downstream monitoring systems. The attack is fully executable over the network without requiring any form of authentication or special privileges on the target server."
}