Description
@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default.
Recommendation
Update the @logtape/syslog package to the latest compatible version. Followings are version details:
Affected version(s): **< 1.3.11 >= 2.0.0, < 2.0.14 >= 2.1.0, <= 2.1.4** Patched version(s): **1.3.11 2.0.14 2.1.5**
References
Could your website be exposed too?
SmartScanner can check your website for @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references - CVE-2026-110725
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
- Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
- fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization - CVE-2026-86818
You might also like:
See something that needs correcting? Let us knowUpdated August 26, 2026