CVE-2026-54511: Log Injection and Structured Data Key Injection in @logtape/syslog

The vulnerability CVE-2026-54511 target-analyzes the @logtape/syslog package, which acts as the syslog transport sink for the LogTape logging ecosystem. This framework is responsible for sending log streams to remote syslog collectors or centralized Security Information and Event Management (SIEM) systems.

When structured logging is enabled by setting SyslogSinkOptions.includeStructuredData to true, the sink outputs key-value pairs representing application event attributes. This feature facilitates detailed metadata extraction by downstream processors.

However, the implementation fails to escape C0 control characters in values and fails to enforce character grammar rules on parameter keys. The missing sanitization opens two distinct attack vectors: CRLF/frame injection and structured data key parameter injection.

The underlying flaw resides in how structured data is compiled within packages/syslog/src/syslog.ts before socket transmission. According to RFC 5424 specifications, metadata elements inside structured data blocks must be sanitized to prevent boundary crossing.

Under RFC 6587 TCP syslog transport, non-transparent framing separates messages using literal newline (\n) delimiters. Because the vulnerable package does not strip or replace C0 control characters (specifically characters from U+0000 to U+001F) in structured values, an attacker who supplies a value containing a newline can force the sink to write a literal newline into the socket. The receiving syslog daemon parses this byte as a message delimiter and treats everything following it as a separate log frame.

Furthermore, the package does not validate keys against the RFC 5424 SD-NAME standard. This standard dictates that parameter keys must be between 1 and 32 characters and only consist of printable US-ASCII characters, excluding spaces, equals signs, quotes, and closing brackets. The lack of checking allows an attacker to supply keys that inject brackets or quotes, altering the layout of the structured metadata blocks.

In versions prior to the fix, the escapeStructuredDataValue routine only targeted backslashes, double quotes, and closing brackets:

// VULNERABLE: Only replaces standard escapable characters
function escapeStructuredDataValue(value: string): string {
  return value
    .replace(/\\/g, "\\\\")
    .replace(/"/g, '\\"')
    .replace(/]/g, "\\\]");
}

This simple replacement fails to neutralize \n (LF), \r (CR), or \0 (Null bytes), which are written verbatim to the output buffer. The patch introduced in commit 7a6e5b9ddf7915edfff78fa129bc17c979b2a623 rewrote this routine to traverse strings character-by-character and escape control characters into their decimal #NNN equivalent:

// PATCHED: Escapes control characters to standard decimal formats
function escapeStructuredDataValue(value: string): string {
  let result = "";
  for (const char of value) {
    const charCode = char.charCodeAt(0);
    if (charCode <= 31) {
      // Safe decimal representation for C0 characters
      result += `#${charCode.toString(10).padStart(3, "0")}`;
    } else if (char === "\\") {
      result += "\\\\";
    } else if (char === '"') {
      result += '\\"';
    } else if (char === "]") {
      result += "\\\]";
    } else {
      result += char;
    } 
  } 
  return result;
}

To remediate key injection, a validator function named isStructuredDataName was added to verify every property key against the RFC 5424 SD-NAME constraints:

function isStructuredDataName(name: string): boolean {
  if (name.length < 1 || name.length > 32) return false;
  for (const char of name) {
    const charCode = char.charCodeAt(0);
    if (
      charCode <= 32 || charCode > 126 ||
      char === "=" || char === "]" || char === '"'
    ) {
      return false;
    } 
  }
  return true;
}

Properties with keys that fail this check are silently omitted from serialization, preventing metadata pollution.

Exploitation of this vulnerability requires that an application log user-controlled input as structured properties. Consider an administrative application logging user registration profile metadata:

logger.info("User registered", { bio: req.body.bio });

An attacker can submit a registration payload where the bio property contains a trailing newline followed by a valid syslog header and a custom payload. Because the newline character is not sanitized, the logging system generates a single TCP packet containing multiple syslog messages.

Additionally, if keys are dynamically mapped from HTTP request headers and logged, submitting a header like X-Header-Injected]evil_property causes the parser to identify ] as the termination of the structured data block. The rest of the key and value then leak into the text body of the log message, potentially causing downline SIEM parsing failures.

The impact of CVE-2026-54511 is severe, as reflected by its CVSS base score of 8.6. The primary security impact is the potential compromise of downstream infrastructure integrity.

By leveraging syslog framing injection, attackers can write arbitrary syslog headers with false origins, severity levels, facilities, and hostnames. For example, an attacker can generate a false authentication success log that appears to originate from a domain controller, neutralizing security alerts.

The Scope (S) metric is set to Changed (C) because the vulnerability allows exploitation to transition from the target software application into the surrounding monitoring and SIEM environment. This capability to poison central logging stores disrupts forensic analysis and compromises the integrity of organizational compliance records.

Remediation is achieved by updating @logtape/syslog to a patched release. The fixes are contained in versions 1.3.11, 2.0.14, and 2.1.5.

If immediate dependency updates are not viable, security administrators should set includeStructuredData: false in the SyslogSinkOptions configuration. This action bypasses the structured data generation path entirely, protecting the system from both CRLF and key-injection vectors.

// Temporary mitigated sink setup
const secureSyslogSink = getSyslogSink({
  host: "syslog-receiver.internal",
  port: 514,
  transport: "tcp",
  includeStructuredData: false // Mitigates the risk prior to library update
});

In addition, developers can implement a temporary gateway sanitization step that strips characters with char codes below 32 from all fields before passing objects to the log interface.