CVE-2026-1245
📋 TL;DR
A code injection vulnerability in binary-parser library versions before 2.3.0 allows attackers to execute arbitrary JavaScript code when untrusted input is used in parser field names or encoding parameters. This affects any Node.js application using vulnerable versions of binary-parser to parse untrusted data. Successful exploitation gives attackers full control of the Node.js process.
💻 Affected Systems
- binary-parser
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Node.js process allowing arbitrary code execution, data theft, privilege escalation, and lateral movement within the environment.
Likely Case
Remote code execution leading to application compromise, data exfiltration, and potential server takeover.
If Mitigated
No impact if input validation prevents untrusted data from reaching vulnerable parser functions.
🎯 Exploit Status
Exploitation requires attacker to control parser field names or encoding parameters. Public proof-of-concept exists in GitHub pull request #283.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0
Vendor Advisory: https://github.com/keichi/binary-parser/pull/283
Restart Required: Yes
Instructions:
1. Update binary-parser to version 2.3.0 or later using npm update binary-parser. 2. Restart all Node.js applications using the library. 3. Test application functionality after update.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to ensure only trusted, whitelisted values are used as parser field names and encoding parameters.
Library Pinning
allPin binary-parser to version 2.3.0+ in package.json to prevent accidental downgrade.
npm install binary-parser@^2.3.0
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all data passed to binary-parser functions.
- Isolate vulnerable applications in network segments with restricted outbound connectivity.
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/binary-parser/package.json for version number below 2.3.0.Check Version:
npm list binary-parser | grep binary-parserVerify Fix Applied:
Verify binary-parser version is 2.3.0 or higher using npm list binary-parser.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from Node.js applications
- Suspicious JavaScript execution patterns
- Unexpected network connections from Node.js processes
Network Indicators:
- Outbound connections to unexpected destinations from Node.js applications
- Command and control traffic patterns
SIEM Query:
process.name:node.exe AND (process.cmdline:*binary-parser* OR process.cmdline:*eval*)