DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54511: CVE-2026-54511: Log Injection and Structured Data Key Injection in @logtape/syslog

#security #cve #cybersecurity

CVE-2026-54511: Log Injection and Structured Data Key Injection in @logtape/syslog

Vulnerability ID: CVE-2026-54511
CVSS Score: 8.6
Published: 2026-08-26

CVE-2026-54511 is a critical security vulnerability in the @logtape/syslog package, which serves as the syslog sink for the LogTape logging library. The flaw is caused by a failure to neutralize C0 control characters in structured data values and to validate keys against RFC 5424 SD-NAME specifications when structured data output is enabled. Remote attackers can leverage this defect to terminate TCP syslog frames and append completely forged syslog records to downstream collectors, compromising the integrity of audit trails and SIEM databases.

TL;DR

Unescaped control characters and unvalidated keys in LogTape's syslog structured data output allow remote attackers to inject forged log records and corrupt structured logs.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-93 / CWE-117
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.6 (High)
  • EPSS Score: Not Available
  • Impact: Integrity Compromise (SIEM / Log Forgery)
  • Exploit Status: PoC (Regression Unit Tests)
  • CISA KEV Status: Not Listed

Affected Systems

  • @logtape/syslog
  • @logtape/syslog: < 1.3.11 (Fixed in: 1.3.11)
  • @logtape/syslog: >= 2.0.0, < 2.0.14 (Fixed in: 2.0.14)
  • @logtape/syslog: >= 2.1.0, < 2.1.5 (Fixed in: 2.1.5)

Code Analysis

Commit: 7a6e5b9

Fix syslog log injection and dynamic key processing flaws in @logtape/syslog.

Exploit Details

  • Regression Unit Tests: The official patch repository contains test scenarios demonstrating how key-value control character sequences translate directly into raw outputs in vulnerable versions.

Mitigation Strategies

  • Upgrade @logtape/syslog to patched versions (1.3.11, 2.0.14, or 2.1.5).
  • Disable structured data in syslog options by setting includeStructuredData to false.
  • Sanitize all user-controlled values to remove C0 control characters before they reach the logger.

Remediation Steps:

  1. Identify all Node.js or Deno applications using @logtape/syslog.
  2. Update dependencies using standard package managers (npm install @logtape/syslog@latest or denofallback equivalent).
  3. If utilizing JSR imports in Deno, ensure the import points to a secure tag (e.g., jsr:@logtape/syslog@^2.1.5).
  4. Verify the application syslog configuration to confirm that temporary workarounds can be retired once patched.

References

Read the full report for CVE-2026-54511 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)