AIKIDO-2026-300232

TL;DR

morgan's escapeLogField helper neutralizes control characters, Unicode line separators, and the backslash in token values, but not the double quote that closes quoted fields in the Apache combined log format. A value placed into a quoted field, such as user-agent, referrer, or a Basic auth username, can contain an unescaped double quote and terminate that field early, so the rest of the value is read as a separate, later log field. Log consumers that parse fields by position, such as Logstash/grok pipelines or other SIEM tooling, can be misled into recording forged or shifted field values, and a custom format with an attacker-influenced field ahead of a server-controlled field can spoof values like a status code. The fix escapes the double quote in escapeLogField so a quoted value can no longer break out of its field.