CVE-2026-1245: Code Injection Flaw Hits Node.js binary-parser

CVE-2026-1245, a code injection flaw, affects the binary-parser library used with Node.js and allows attackers to execute arbitrary JavaScript on a server when untrusted input is processed dynamically. The vulnerability stems from how the library builds parsers, with versions below 2.3.0 dynamically generating JavaScript code at runtime using the Function constructor, which can incorporate unsanitised user-supplied values into the generated code.

According to the vulnerability note, this means that if a parser is built from external input, the unsanitised values can alter the generated code and enable attacker-controlled JavaScript execution. The advisory notes that the risk is not universal, as static, hardcoded parser definitions are not affected, but where parser definitions are built dynamically from untrusted data the attacker may gain access to local data, manipulate application logic, or execute system commands depending on the environment.

The vulnerability was identified by Maor Caplan and has been patched by the library maintainer, Keichi Takahashi, with a recommendation to upgrade to version 2.3.0 or later.