NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #2594 most downloaded on npm
HTTP request logger middleware for node.js
Last release 23 days ago
11 Sep 2026
Ships unpredictably
gaps range from 2 weeks to 5.3 years
Nearly every release is documented
notes for 30 of 30 stable releases
Nothing withdrawn
no release was ever pulled
13 years old
30 releases · first in 2014
Security fix for CVE-2026-87859 ( GHSA-9f6g-j8ch-79g4 )
Full Changelog: 1.12.0...1.12.1
One column per quarter.
fix: upgrade http:// to https:// in README by @hanu-14 in #363
Full Changelog: 1.11.0...1.12.0
objectModeNO_COLOR environment variable in the dev formatFixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m
Security Fix:
:remote-user token to prevent log injection
Full Changelog: 1.10.0...1.11.0
renaming simple to sample in readme by @ryhinchey in #237
Full Changelog: 1.10.0...1.10.1
Fix trailing space in colored status code for dev format
:total-time tokendev formateval usage with Function constructorprocess to check for listenersres.writeHead patch missing return valueFix using special characters in format
Use res.headersSent when available
res.headersSent when availablesafe-buffer for improved Buffer APIBuffer loadingdeps: debug@2.6.8 Fix DEBUG_MAX_ARRAY_LENGTH deps: ms@2.0.0
DEBUG_MAX_ARRAY_LENGTHFix deprecation messages in WebStorm and other editors
DEBUG_FD set to 1 or 2Deprecated DEBUG_FD environment variable
undefined argument to token functionsDEBUG_FD environment variableAdd digits argument to response-time token
digits argument to response-time token* deps: basic-auth@~1.0.3
Add morgan.compile(format) export
morgan.compile(format) exportdev formatresponse-time token to not include response latencystatus token incorrectly displaying before response in dev formatundefined or a stringreq and res tokensres.getHeader in res tokenCONNECT requestsUpgrade requestsdev formatskip optionFix isFinished(req) when data buffered
isFinished(req) when data bufferedFix high intensity foreground color for bold
- deps: debug@~2.1.1 - deps: on-finished@~2.2.0
iso for the common ISO 8601 date time format
clf for the common log formatiso for the common ISO 8601 date time formatweb for the common RFC 1123 date time formatbuffer optioncommon and combined formats"Fix handling of pipelined requests
- Add debug messages - deps: depd@~1.0.0
debug messagesFix req.ip integration when immediate: false
req.ip integration when immediate: falseRemove us-used bytes dependency
bytes dependencyAssert if format is not a function or string
format is not a function or string* deps: on-finished@2.1.0
Work-around v8 generating empty stack traces
Fix exception when global Error.stackTraceLimit is too low
Error.stackTraceLimit is too lowDeprecate default format -- use combined format instead
:remote-user tokencombined log formatcommon log formatmorgan(format, options) function signaturedefault format -- use combined format insteaddev formatsimplify method to get remote address
"dev" format will use same tokens as other formats
:response-time token is now empty when immediate used:response-time token is now monotonic:response-time token has precision to 1 μs:status + immediate output in node.js 0.8buffer option to prevent indefinite event loop holdingMake buffer unique per morgan instance
* Initial release
Your coding agent can read these notes before it upgrades. Set up the MCP server →