{"action":"Upgrade node-morgan to 1.12.1+~1.9.10-1 or later.","affected":[{"fixed":"1.12.1+~1.9.10-1","introduced":"0"}],"component":"node-morgan","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.12.1+~1.9.10-1"],"id":"tcs_01M5NW4T5P97BMCC3T26PVA81G","modified_at":"2026-10-01T03:03:52.202121201Z","published_at":"2026-09-11T10:16:53.253Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-87859","https://security-tracker.debian.org/tracker/CVE-2026-87859"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-87859#Debian:14/node-morgan","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-87859"}],"summary":"morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Ap"}