CVE-2026-54511: LogTape Syslog Information Disclosure Flaw

CVE-2026-54511 Overview

CVE-2026-54511 is a log injection vulnerability [CWE-93] in LogTape, a JavaScript/TypeScript logging library. The flaw affects the @logtape/syslog package in versions prior to 1.3.11, 2.0.14, and 2.1.5. The escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters (U+0000 through U+001F), and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. Attackers who control property values or keys forwarded to syslog can forge RFC 5424 records over RFC 6587 non-transparent TCP framing. Forged records can carry arbitrary hosts, applications, PIDs, facilities, or severities, undermining downstream SIEM and log collector integrity.

Critical Impact
An unauthenticated remote attacker can forge syslog records with arbitrary metadata, corrupting downstream log collectors and SIEM data integrity.

Affected Products

LogTape @logtape/syslog versions prior to 1.3.11 (1.x branch)
LogTape @logtape/syslog versions prior to 2.0.14 (2.0.x branch)
LogTape @logtape/syslog versions prior to 2.1.5 (2.1.x branch)

Discovery Timeline

2026-08-26 - CVE-2026-54511 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54511

Vulnerability Analysis

The vulnerability sits in the syslog formatter that produces RFC 5424 records. The escapeStructuredDataValue() helper only escaped backslash, double quote, and closing bracket characters. It ignored C0 control characters, including newline (\n, U+000A) and carriage return (\r, U+000D). When includeStructuredData is enabled and the transport uses RFC 6587 non-transparent TCP framing, a newline in an attacker-controlled value terminates the current frame. Bytes following the newline are parsed by the receiver as a fresh syslog record.

Separately, formatStructuredData() wrote structured-data property keys directly into the output without validating them against the RFC 5424 SD-NAME grammar. A key containing ], =, ", or whitespace can close or corrupt the structured-data element early, allowing an attacker to inject additional SD-IDs or fabricate fields.

Root Cause

The root cause is missing output neutralization for a downstream grammar [CWE-93: Improper Neutralization of CRLF Sequences]. The escape routine treated only the three RFC 5424 metacharacters relevant to value content while ignoring control characters and framing-relevant bytes. Key insertion had no validation at all, violating the SD-NAME production defined in RFC 5424 section 6.

Attack Vector

An attacker supplies data that eventually flows into a LogTape structured-data property value or key. Common sinks include HTTP header values, usernames, request paths, or any user-influenced field that an application logs. When LogTape emits the record to a syslog collector over TCP with non-transparent framing, the attacker's newline or bracket bytes escape the intended field boundary. The forged record can spoof hostname, app-name, procid, facility, or severity, potentially disguising malicious activity or framing another system.

typescript

  * @since 0.12.0
  */
 function escapeStructuredDataValue(value: string): string {
-  return value
-    .replace(/\\/g, "\\\\")
-    .replace(/"/g, '\\"')
-    .replace(/]/g, "\\]");
+  let result = "";
+  for (const char of value) {
+    const charCode = char.charCodeAt(0);
+    if (charCode <= 31) {
+      result += `#${charCode.toString(10).padStart(3, "0")}`;
+    } else if (char === "\\") {
+      result += "\\\\";
+    } else if (char === '"') {
+      result += '\\"';
+    } else if (char === "]") {
+      result += "\\]";
+    } else {
+      result += char;
+    }
+  }
+  return result;
+}
+
+/**
+ * Validates an RFC 5424 SD-NAME value.
+ */
+function isStructuredDataName(name: string): boolean {
+  if (name.length < 1 || name.length > 32) return false;

Source: GitHub commit 7a6e5b9

Detection Methods for CVE-2026-54511

Indicators of Compromise

Syslog records containing unexpected duplicate PRI headers or two VERSION fields within a single TCP frame, suggesting a smuggled record.
Structured-data elements with SD-NAME values that include ], =, ", or whitespace, which the pre-patch code accepted but RFC 5424 forbids.
Records where hostname, app-name, or procid values do not match any known emitter in the environment.

Detection Strategies

Inventory Node.js and Deno services that depend on @logtape/syslog and confirm installed versions against 1.3.11, 2.0.14, and 2.1.5.
Parse ingested syslog at the collector and reject or quarantine records whose SD-NAME or SD-PARAM fields violate the RFC 5424 grammar.
Correlate log-source identity (source IP and TLS certificate) against the claimed hostname and app-name fields, flagging mismatches.

Monitoring Recommendations

Alert on abnormal spikes in syslog frame counts from a single upstream emitter, which can indicate smuggled records.
Monitor for unusual facility or severity distributions from applications that use LogTape.
Track SIEM parsing errors on structured-data elements; a sudden increase is consistent with malformed injection attempts.

How to Mitigate CVE-2026-54511

Immediate Actions Required

Upgrade @logtape/syslog to 1.3.11, 2.0.14, or 2.1.5, matching your current major version.
If upgrade is not immediately possible, set includeStructuredData to false in the syslog sink configuration to remove the injectable surface.
Audit application code for places where untrusted input is passed as a structured-data key and remove or sanitize those keys.

Patch Information

The fix is published in LogTape releases 1.3.11, 2.0.14, and 2.1.5. Patched builds rewrite escapeStructuredDataValue() to encode C0 control characters as #NNN sequences and add isStructuredDataName() validation on SD-NAME keys. See the GitHub Security Advisory GHSA-8h6h-x5pq-56fq for full details.

Workarounds

Disable includeStructuredData on the syslog sink until packages are upgraded.
Switch the transport to RFC 6587 octet-counted framing, which is not vulnerable to newline-based frame termination.
Sanitize attacker-controlled values by stripping \r, \n, and other C0 control characters before passing them to LogTape.

bash

# Upgrade to a patched version using npm
npm install @logtape/syslog@^2.1.5

# Or pin to the fixed 2.0.x release
npm install @logtape/syslog@2.0.14

# Or pin to the fixed 1.3.x release
npm install @logtape/syslog@1.3.11