CERT/CC Warns binary-parser Bug Allows Node.js Privilege-Level Code Execution

CERT/CC has disclosed a vulnerability in the binary-parser npm library, tracked as CVE-2026-1245, which affects all versions prior to 2.3.0, with patches released on 26 November 2025. According to CERT/CC’s advisory, the flaw stems from a lack of sanitisation of user-supplied values, such as parser field names and encoding parameters, when the JavaScript parser code is dynamically generated at runtime via the Function constructor.

The library builds JavaScript source code as a string and compiles it with Function, caching it as an executable function to parse buffers efficiently. If exploited in affected applications that construct parser definitions using untrusted input, an attacker could execute arbitrary JavaScript with the privileges of the Node.js process, potentially accessing local data, altering application logic, or running system commands.

The advisory notes that applications using only static, hard-coded parser definitions are not affected, and users are urged to upgrade to version 2.3.0 and avoid passing user‑controlled values into parser field names or encoding parameters; security researchers credited Maor Caplan with discovering and reporting the flaw. The binary-parser project reportedly attracts about 13,000 downloads per week.