v48.1.12

Update dependency morgan to v1.11.0 [SECURITY]

Notable changes

• add :pid token
• Escape control characters in :remote-user token to prevent log injection

expressjs/morgan (morgan)

v1.11.0

Compare Source

===================

• add :pid token

Security Fix:

• Escape control characters in :remote-user token to prevent log injection
  • Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

List of commits

7cc39c0 (Update dependency morgan to v1.11.0 [SECURITY], 2026-07-10)