Junglewise Threat Intelligence

CVE-2026-54511: @logtape/syslog log injection via unescaped control characters

CVE-2026-54511 · Severity: high · CVSS 8.6 · Published 2026-08-26

Executive brief

@logtape/syslog is a Node.js library for sending application logs to syslog servers in standardized RFC 5424 format. The library fails to properly escape control characters and validate log property keys in structured data, allowing attackers who control log values to inject forged syslog records that impersonate legitimate hosts and applications. This can undermine log integrity at downstream collectors like Splunk, Elastic Stack, and rsyslog, enabling log tampering and obscuring malicious activity.

Technical details

@logtape/syslog's escapeStructuredDataValue() function (in packages/syslog/src/syslog.ts) escapes backslash, quote, and closing bracket per RFC 5424 but omits C0 control characters (U+0000–U+001F), including newline (\n) and carriage return (\r). TCP syslog (RFC 6587 non-transparent framing) uses \n as a frame delimiter; a literal newline in a log value terminates the current frame, and any valid RFC 5424 header following it is accepted by downstream collectors as an authentic separate record. Additionally, structured-data keys are inserted without validation against RFC 5424 SD-NAME rules (printable US-ASCII excluding =, ], ", space; max 32 chars), allowing malicious keys to introduce invalid syntax or prematurely close the structured-data element. Attack requires the library to be deployed with includeStructuredData: true (non-default) and the application to forward attacker-controlled data as log property values or keys. Patched versions (1.3.11, 2.0.14, 2.1.5) escape control characters as printable sequences and validate keys before inclusion.

Affected products

  • dahlia @logtape/syslog < 1.3.11, >= 2.0.0 and < 2.0.14, >= 2.1.0 and <= 2.1.4

Timeline

  • 2026-06-16: disclosed: Vulnerability reported and security advisory published
  • 2026-06-16: patched: Patches released: 1.3.11, 2.0.14, 2.1.5
  • 2026-08-26: advisory: GitHub Advisory Database updated

References