# What changed in morgan

> 6 changes in morgan 1 from its official release notes, upgrade guides and advisories: 3 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/morgan/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## morgan 1

### Security

- Includes a security fix for CVE-2026-87859. (1.12.1) — [release notes](https://github.com/expressjs/morgan/releases/tag/1.12.1), [security advisory](https://github.com/advisories/GHSA-9F6G-J8CH-79G4)
- morgan vulnerable to Log Forging via unescaped Unicode line separators (1.12.0) — [security advisory](https://github.com/advisories/GHSA-JXFW-X594-9X9M)
- Escapes control characters in the :remote-user token to prevent log injection. (1.11.0) — [release notes](https://github.com/expressjs/morgan/releases/tag/1.11.0), [security advisory](https://github.com/advisories/GHSA-4VJ7-5MJ6-JM8M)

### New APIs and options

- Setting NO_COLOR removes color from the dev format. (1.12.0) — [release notes](https://github.com/expressjs/morgan/releases/tag/1.12.0)
- Adds the :pid token for logging the process ID. (1.11.0) — [release notes](https://github.com/expressjs/morgan/releases/tag/1.11.0)

### Behavior and default changes

- Morgan passes objects through to streams in objectMode. (1.12.0) — [release notes](https://github.com/expressjs/morgan/releases/tag/1.12.0)