binary-parser library has a code injection vulnerability
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | binary-parser | < 2.3.0 | 2.3.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-1245
- https://github.com/keichi/binary-parser/pull/283
- https://github.com/keichi/binary-parser
- https://kb.cert.org/vuls/id/102648
- https://www.cve.org/CVERecord?id=CVE-2026-1245
- https://www.kb.cert.org/vuls/id/102648
- https://www.npmjs.com/package/binary-parser
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-94- Platform
- npm
- Package
binary-parser- Disclosed
- 20.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m39p-34qh-rh3w - CC BY 4.0
Vulnerability history: binary-parser
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.