CVE-2026-54511

Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5

Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to true. First, the escapeStructuredDataValue() function in packages/syslog/src/syslog.ts fails to neutralize C0 control characters (U+0000 through U+001F). In TCP syslog environments using non-transparent framing, an attacker-controlled newline can terminate a frame and allow subsequent bytes to be interpreted as a forged record with arbitrary hosts, applications, process identifiers, facilities, or severity levels. Second, the formatStructuredData() function inserts property keys without validating them against the RFC 5424 SD-NAME grammar. A key containing forbidden characters, such as a closing bracket, can terminate or corrupt the structured-data element. These issues can undermine the integrity of downstream collectors and SIEM systems.

Recommendations Update @logtape/syslog to version 1.3.11 or later. Update @logtape/syslog to version 2.0.14 or later. Update @logtape/syslog to version 2.1.5 or later. As a temporary mitigation, set includeStructuredData to false.