Morgan is a production-grade HTTP request logger middleware for Node.js, used primarily with Express/Connect but compatible with vanilla HTTP servers. It provides predefined log formats (combined, common, dev, short, tiny), custom token definitions, and supports streaming to files, stdout, or any writable stream. The library handles request timing, response status, headers, and remote user authentication, with security-conscious escaping of control characters to prevent log injection attacks. Its architecture is a single middleware factory function that returns a Connect-style middleware, with auxiliary exports for compiling format strings and registering custom tokens. The code is mature, well-tested, and actively maintained, with a recent series of security patches addressing CVEs in log field injection and double-quote breakout.