CVE-2026-54511: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54511 is a syslog log injection vulnerability in the @logtape/syslog package of the LogTape logging library, caused by improper neutralization of CRLF sequences and unvalidated structured data keys. It affects all versions prior to 1.3.11, versions 2.0.0–2.0.13, and versions 2.1.0–2.1.4 of the @logtape/syslog package (available on both npm and JSR). The vulnerability was disclosed on June 16, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The vulnerability stems from two related output-encoding flaws in packages/syslog/src/syslog.ts (CWE-93: CRLF Injection; CWE-117: Improper Output Neutralization for Logs). First, escapeStructuredDataValue() escapes backslashes, double quotes, and closing brackets per RFC 5424, but fails to escape C0 control characters (U+0000–U+001F), including newline (\n) and carriage return (\r). Since RFC 6587 non-transparent TCP syslog framing uses \n as a frame delimiter, an attacker-controlled value containing a literal newline terminates the current syslog frame; bytes following it are interpreted as a new frame and, if they form a valid RFC 5424 header, are accepted as an authentic record by downstream collectors. Second, formatStructuredData() inserts property keys into the structured-data element without validating them against the RFC 5424 SD-NAME grammar, allowing keys containing ], =, ", spaces, or control characters to corrupt or prematurely close the structured-data element. Both bugs are only exploitable when includeStructuredData: true is configured, which is non-default (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker who can influence log property values or keys to inject forged RFC 5424 syslog records attributed to arbitrary hosts, applications, process IDs, facilities, or severity levels into downstream collectors and SIEMs (including rsyslog, syslog-ng, Splunk, and Elastic Stack). This undermines log integrity, enabling attackers to obscure malicious activity by injecting misleading entries around legitimate ones, break SIEM correlation rules, or cause downstream log parsers to malfunction. There is no confidentiality or availability impact; the impact is entirely on integrity, with a changed scope affecting systems beyond the vulnerable component itself (GitHub Advisory).

No public proof-of-concept exploit code has been published beyond the minimal Node.js snippet included in the GitHub security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the target application has includeStructuredData: true configured (non-default) and forwards attacker-controlled values or keys as log properties (GitHub Advisory).

1. Identify a target application: Find an application using @logtape/syslog (versions < 1.3.11, 2.0.0–2.0.13, or 2.1.0–2.1.4) with includeStructuredData: true configured that forwards attacker-controlled input (e.g., HTTP request headers, user-supplied form fields) as log record properties.
2. Craft a malicious payload: Construct an input value containing a literal newline followed by a valid RFC 5424 syslog header, for example: normal\n<134>1 2026-01-01T00:00:00Z forged.host evil-app 9999 - - INJECTED MESSAGE.
3. Deliver the payload: Submit the crafted value through the application's input surface (e.g., a User-Agent header, a form field, or an API parameter) that gets logged as a structured data property value.
4. Frame injection occurs: The unescaped newline in the structured data value terminates the current RFC 6587 TCP syslog frame. The bytes following the newline begin a new frame containing the attacker-crafted RFC 5424 header.
5. Forged record accepted downstream: The downstream syslog collector (rsyslog, syslog-ng, Splunk, etc.) receives and processes the injected frame as an authentic log record with the attacker-specified host, application name, severity, and message, corrupting log integrity and potentially evading SIEM detection rules (GitHub Advisory).

• Logs: Syslog records appearing in downstream collectors with unexpected hostnames, application names, process IDs, or severity/facility combinations that do not correspond to known infrastructure; duplicate or out-of-sequence log entries surrounding legitimate records.
• Network: TCP syslog streams (typically port 514 or 6514) containing embedded newline characters within structured data fields, or RFC 5424 frames with mismatched or spoofed HOSTNAME and APP-NAME fields originating from a single source IP.
• Application Logs: Log entries in the originating application where structured data values contain literal \n, \r, or other C0 control characters (U+0000–U+001F) prior to patching; entries with structured data keys containing spaces, =, ], or " characters.
• SIEM Alerts: Unexpected spikes in log volume from a single source, or SIEM correlation rule failures caused by malformed or injected structured-data elements breaking parser expectations (GitHub Advisory).

Upgrade @logtape/syslog to one of the patched versions: 1.3.11, 2.0.14, or 2.1.5, which replace C0 control characters in structured data values with printable #NNN sequences and skip property keys that fail RFC 5424 SD-NAME validation (Release 1.3.11, Release 2.0.14, Release 2.1.5). If immediate patching is not possible, set includeStructuredData: false (the default) to disable the vulnerable code path entirely. As an additional defense-in-depth measure, implement strict input validation and sanitization on all log message values before they reach the syslog transport, filtering C0 control characters and RFC 5424 frame delimiters (GitHub Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article on the structured data injection issue shortly after disclosure. The advisory was also noted on Mastodon via The Hacker Wire's account. No significant vendor statements beyond the maintainer's own advisory and patch have been identified (GitHub Advisory).