AIKIDO-2026-656294

@logtape/syslog is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection')

Improper Neutralization of CRLF Sequences ('CRLF Injection')CVE-2026-54511 Published 5 days ago

High Risk

This Affects:

@logtape/syslog

0.0.0 - 1.3.10

Fixed in 1.3.11

2.0.0 - 2.0.13

Fixed in 2.0.14

2.1.0 - 2.1.4

Fixed in 2.1.5

Are you affected? Scan for Free

TL;DR

@logtape/syslog allowed structured data values containing C0 control characters to inject forged syslog frames when SyslogSinkOptions.includeStructuredData was enabled. The fix sanitizes structured data values by escaping control characters into printable #NNN sequences and skips structured-data parameters with invalid RFC 5424 SD-NAME keys, preventing frame/control injection.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@logtape/syslog is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in versions 0.0.0 - 1.3.10, 2.0.0 - 2.0.13 and 2.1.0 - 2.1.4.