CVE-2026-1245: Binary-Parser Library RCE Vulnerability

CVE-2026-1245 Overview

A code injection vulnerability exists in the binary-parser library prior to version 2.3.0 that allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.

Critical Impact
Attackers can achieve arbitrary code execution within Node.js applications by supplying malicious input to parser field names or encoding parameters, potentially leading to full system compromise.

Affected Products

binary-parser npm package versions prior to 2.3.0

Discovery Timeline

2026-01-20 - CVE CVE-2026-1245 published to NVD
2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-1245

Vulnerability Analysis

This vulnerability stems from the binary-parser library's approach to dynamically generating JavaScript code for parsing binary data. When constructing parsers, the library interpolates user-supplied field names and encoding parameters directly into code strings that are subsequently evaluated. Without proper sanitization or validation of these inputs, an attacker can inject malicious JavaScript code that executes within the Node.js runtime context.

The impact of successful exploitation includes unauthorized access to application data, modification of application behavior, and potential lateral movement within the server environment. Applications that process untrusted binary data formats or allow user-controlled parser configurations are particularly vulnerable.

Root Cause

The root cause is improper input validation and the unsafe use of dynamic code generation. The binary-parser library constructs executable JavaScript code by concatenating user-supplied values (such as field names and encoding parameters) directly into code strings. This pattern is inherently dangerous when handling untrusted input, as it creates a direct path for code injection attacks.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by providing specially crafted input values to parser configurations. When the application uses these malicious values as field names or encoding parameters, the injected code is incorporated into the dynamically generated parser and executed during the parsing operation.

The vulnerability is exploited by injecting JavaScript syntax-breaking characters and malicious code payloads into field name or encoding parameter positions. For example, an attacker could close existing string or function contexts and append arbitrary JavaScript statements that execute when the parser processes data.

For detailed technical information about the vulnerability mechanism, refer to the CERT Vulnerability Advisory #102648 and the GitHub Pull Request that addresses this issue.

Detection Methods for CVE-2026-1245

Indicators of Compromise

Unusual Node.js process behavior including unexpected network connections or file system access
Presence of binary-parser package versions below 2.3.0 in package.json or package-lock.json
Application logs showing parsing errors with suspicious characters in field names or encoding values
Unexpected child process spawning from Node.js applications utilizing binary parsing functionality

Detection Strategies

Implement software composition analysis (SCA) scanning to identify vulnerable binary-parser versions in your dependency tree
Monitor application logs for parsing exceptions that may indicate exploitation attempts
Deploy runtime application self-protection (RASP) solutions to detect and block code injection attempts
Review application code for dynamic parser configuration using untrusted input sources

Monitoring Recommendations

Enable verbose logging for binary parsing operations to capture potential injection attempts
Implement anomaly detection for Node.js process behavior, particularly around code execution patterns
Monitor npm audit reports and vulnerability databases for updates related to this CVE
Track network traffic from Node.js applications for unexpected outbound connections

How to Mitigate CVE-2026-1245

Immediate Actions Required

Upgrade binary-parser to version 2.3.0 or later immediately
Audit all applications using binary-parser to identify vulnerable deployments
Review application code to ensure user input is never passed directly to parser field names or encoding parameters
Implement input validation to restrict field names and encoding parameters to expected values only

Patch Information

The vulnerability is addressed in binary-parser version 2.3.0 and later. The fix implements proper input sanitization to prevent code injection through field names and encoding parameters. For detailed patch information, see the GitHub Pull Request that addresses this vulnerability.

Additional resources:

Workarounds

Avoid using user-controlled values for parser field names or encoding parameters
Implement strict allowlisting for any dynamic parser configuration values
Isolate binary parsing operations in sandboxed environments or separate processes with limited privileges
Consider using alternative binary parsing libraries that do not rely on dynamic code generation

bash

# Upgrade binary-parser to patched version
npm update binary-parser@^2.3.0

# Verify installed version
npm list binary-parser

# Run npm audit to check for remaining vulnerabilities
npm audit