@logtape/syslog CVE-2026-54511

Exploitation requires SyslogSinkOptions.includeStructuredData: true to be explicitly set in the application's syslog sink configuration - this option defaults to false and must be opted into. Additionally, attacker-controlled data must reach a log record's structured properties; this is most likely when an application automatically spreads HTTP request headers, query parameters, or other external metadata into log records using patterns such as Object.assign or spread operators. The TCP syslog transport (RFC 6587 non-transparent framing) must be in use; UDP syslog does not use newline frame delimiters and is not subject to the frame-injection vector (though malformed structured data still results). The SD-NAME key injection path further requires attacker-controlled property key names, a less common but possible pattern when forwarding arbitrary metadata. Limiting factors: the non-default configuration is the primary gate; deployments using the default (includeStructuredData omitted or false) are entirely unaffected. Authentication is not required by the CVSS vector (PR:N), but the attacker must be able to influence data that the application chooses to log as structured properties.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, 8.6) scores high partly because scope is changed - the integrity of downstream syslog infrastructure is affected, not just the originating process. However, two factors temper real-world risk: (1) the vulnerability only triggers with includeStructuredData: true, an opt-in non-default setting, and (2) exploitation additionally requires attacker-controlled data to reach log properties (e.g., an application spreading request headers directly into log records). These conditions argue for AC:H in an independent assessment rather than AC:L. No EPSS score was provided in source intelligence. No CISA KEV listing was identified at time of analysis, suggesting exploitation has not been observed at scale. A proof-of-concept is publicly available via the GHSA advisory, lowering the bar for exploitation against mis-configured deployments. The 'RCE' tag in the input data is inconsistent with the CVSS impact metrics (C:N/I:H/A:N) and the technical description - this is log injection, not remote code execution; the tag should be treated as a mistagging. The scope-changed integrity impact is real but limited to log record forgery and SIEM correlation disruption rather than host compromise.

An attacker sends an HTTP request to a Node.js web application that spreads request headers into LogTape structured log properties and has SyslogSinkOptions.includeStructuredData: true enabled. A header value such as 'normal\n<134>1 2026-01-01T00:00:00Z forged evil - - - INJECTED' passes through the unpatched escapeStructuredDataValue() with the newline intact; when the syslog sink forwards the message over TCP, the newline terminates the current frame and the forged RFC 5424 header opens a new one. The downstream rsyslog or Splunk collector ingests the injected record as if it originated from host 'forged' at the specified timestamp, corrupting audit trails and potentially suppressing alerts. Proof-of-concept code is publicly available in the GHSA advisory.