npm / morgan
morgan
What changed in morgan 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.
3 security2 new APIs and options1 behavior and defaults
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmorgan 16 changes
Security 3
Includes a security fix for CVE-2026-87859.
morgan vulnerable to Log Forging via unescaped Unicode line separators
Escapes control characters in the :remote-user token to prevent log injection.
New APIs and options 2
Setting NO_COLOR removes color from the dev format.
Adds the :pid token for logging the process ID.
Behavior and default changes 1
Morgan passes objects through to streams in objectMode.