Code Injection Flaw in Binary-Parser Library by Keichi
CVE-2026-1245

6.5MEDIUM

Key Information:

Vendor

Binary-parser

Status
Binary-parser
Vendor
CVE Published:
20 January 2026

What is CVE-2026-1245?

The binary-parser library prior to version 2.3.0 is susceptible to a code injection vulnerability that permits the execution of arbitrary JavaScript code. This issue arises when untrusted values are inserted into parser field names or encoding parameters, leading to the direct interpolation of these values into dynamically generated code without proper sanitization. This lack of validation enables attackers to potentially execute malicious code within the Node.js context, posing significant security risks.

Affected Version(s)

binary-parser 0 < 2.3.0

References

https://github.com/keichi/binary-parser/pull/283
https://github.com/keichi/binary-parser
https://www.npmjs.com/package/binary-parser

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.