High, CVSS 8.6npmPublished
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
CVE-2026-54511 · GHSA-8h6h-x5pq-56fq
- Affected
- npm @logtape/syslog >= 2.1.0, <= 2.1.4; >= 2.0.0, < 2.0.14; < 1.3.11
- Fixed in
- 1.3.112.1.52.0.14· Vendor fix available
- Issue
- @logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue() in packages/syslog/src/syslog.ts escapes \, ", and ] per RFC 5424 but does not escape newline (\n), carriage return (\r), or any other C0 control characters (U+0000–U+001F): TCP syslog commonly uses \n as a frame delimiter (RFC 6587, non-transparent framing). If an attacker-controlled value contains a literal newline, that newline terminates the current syslog frame. Bytes following the newline begin a new frame, and if they form a valid RFC 5424 header (<PRI1 …), a downstream collector will accept them as a separate, authentic-looking syslog record. 2. Unvalidated SD-NAME keys Structured data parameter keys are inserted into the message without validation or escaping: RFC 5424 defines SD-NAME as printable US-ASCII…
Recommended action: Upgrade to 2.1.5, 2.0.14 or 1.3.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.