This vulnerability exists in the @logtape/syslog logging library prior to specific releases. The escapeStructuredDataValue() function fails to neutralize C0 control characters (U+0000 through U+001F) in structured data values and the formatStructuredData() function accepts property keys without validating the RFC 5424 SD‑NAME grammar. An attacker able to supply such values through includeStructuredData can terminate an RFC 6587 syslog frame with an injected newline and craft a forged RFC 5424 record. The forged message can carry arbitrary host, application, process identifier, facility, or severity levels, thereby compromising the integrity of downstream collectors and SIEM systems. This weakness corresponds to CWE‑117 (Improper Output Neutralization for Log File) and CWE‑93 (Improper Handling of Control Characters), representing improper output neutralization and control‑character handling.

The affected product is @logtape/syslog from the dahlia organization. Versions prior to 1.3.11, 2.0.14, and 2.1.5 are vulnerable. Any project that imports logtape/syslog or references the same located package is impacted until the specified releases are applied.

The CVSS score of 8.6 classifies this as high severity; the EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalogue. The likely attack vector is remote exploitation through a syslog client that forwards structured data to a vulnerable application, either directly or via a compromised service that accepts syslog frames. If an attacker can control the structured‑data key or value, they can forge log entries that appear legitimate to collectors, potentially leading to unauthorized influence over log‑based monitoring and alerting.