AIKIDO-2026-656294
@logtape/syslog is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection')
86
High Risk
This Affects:
@logtape/syslogTL;DR
@logtape/syslog allowed structured data values containing C0 control characters to inject forged syslog frames when SyslogSinkOptions.includeStructuredData was enabled. The fix sanitizes structured data values by escaping control characters into printable #NNN sequences and skips structured-data parameters with invalid RFC 5424 SD-NAME keys, preventing frame/control injection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@logtape/syslog is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in versions 0.0.0 - 1.3.10, 2.0.0 - 2.0.13 and 2.1.0 - 2.1.4.
How to fix this
Upgrade the @logtape/syslog library to the patch version.
Links
GitHub Releases
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.