Mangled/broken headers when using morgan

[SPodjasek]

While updating some components, I ran into a rather interesting problem related to using this library for logging express requests. My express instance runs @tus/server, which uses srvx for API unification, and it internally uses flat array, not object, to write response headers - and those headers were broken. At first I've modified srvx internals to find out that change from Array to Object fixed my issue, but Node docs list array as supported value for headers - so it should work with arrays.

TL;DR

I know it's a bit convoluted, but to put it simply – the issue is that with morgan enabled, instead of response headers like these:

HTTP/1.1 200 
X-Powered-By: Express
content-type: text/plain
x-testing: true
Date: Tue, 17 Jun 2025 19:30:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

I get these instead:

HTTP/1.1 200 
X-Powered-By: Express
c: o
t: r
x: -
Date: Tue, 17 Jun 2025 19:30:10 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

Environment information

Version: 1.10.0

Platform: Linux seba-stationary 6.8.0-60-generic #63-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 19:04:15 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Node.js version: v22.16.0

What steps will reproduce the bug?

There's a sample repository here: https://github.com/SPodjasek/poc-srvx-node-header-issue

1. Clone and run: npm install && node index.js
2. Fetch response: curl -v localhost:3000, see broken headers
3. Disable morgan on line 7
4. Fetch again

[ctcpip]

the root cause is this issue: jshttp/on-headers#15

morgan is internally calling (eventually) setHeadersFromArray in on-headers, passing in: ['content-type', 'text/plain', 'x-testing', 'true'], so it ends up setting headers:

content-type -> c: o
text/plain -> t: e
x-testing -> x: -

and then t gets written over:

true -> t: r

aside from that bug in on-headers, I still don't like the fact that what is ostensibly a logging middleware is inadvertently manipulating response headers (or anything for that matter)

[caasi]

A quick workaround is enabling the immediate log mode to prevent calling onHeaders.

morgan("whatever", { immediate: true });

[ctcpip]

resolved via GHSA-76c9-3jph-rj3q

[ctcpip]

morgan 1.1.0 is published now with the patched version of on-headers