CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

DEBIAN-CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

UBUNTU-CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908

multiparty , a Node.js library for parsing multipart/form-data request bodies, is affected by a Denial of Service vulnerability in versions 2.1.0 through 4.3.0 . The root cause is that the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. A...

CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

EUVD-2026-75976

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

promptfoo v0.123.0

Promptfoo: LLM evals & red teaming promptfoo is a CLI and library for evaluating and red-teaming LLM-based apps. Stop using trial-and-error... start shipping secure, reliable agents Website · Getting Started · Red Teaming · Documentation · Discord Promptfoo is now part of OpenAI. Promptfoo remain...

Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

Linux Distros Unpatched Vulnerability : CVE-2026-87776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still...

PT-2026-89865

Name of the Vulnerable Software and Affected Versions compression versions prior to 1.8.2 Description This Node.js and Express compression middleware contains a memory leak. When a client aborts a connection while a compressed response is being transmitted, the zlib stream used for compression is...

PT-2026-89815

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...