CVE-2026-54511: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in dahlia logtape

The vulnerability exists in the escapeStructuredDataValue() function of the @logtape/syslog package within dahlia logtape. It fails to neutralize C0 control characters (U+0000 through U+001F) in structured data values and does not validate property keys against the RFC 5424 SD-NAME grammar. When includeStructuredData is true, an attacker can inject newline characters to prematurely terminate an RFC 6587 non-transparent TCP syslog frame, causing subsequent bytes to be interpreted as a forged RFC 5424 record. Additionally, malformed keys with forbidden characters can corrupt or terminate the structured-data element. This allows attackers controlling property values or keys to forge syslog records with arbitrary hosts, applications, process identifiers, facilities, or severity levels, compromising downstream log collectors and SIEM systems. The vulnerability is addressed in versions 1.3.11, 2.0.14, and 2.1.5.

Exploitation allows attackers to inject forged syslog records with arbitrary metadata, potentially misleading log analysis and security monitoring systems. This undermines the integrity of logs collected by downstream systems such as SIEMs, which rely on accurate and trustworthy log data for security decisions. The vulnerability does not impact confidentiality or availability but has a high impact on integrity.

A fix is available in dahlia logtape versions 1.3.11, 2.0.14, and 2.1.5. Users should upgrade to one of these versions or later to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or that no action is required.