CVE-2026-1245: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1245 is a code injection vulnerability in the binary-parser npm library (versions prior to 2.3.0) for Node.js that allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code (via the Function constructor) without sanitization. Disclosed on January 20, 2026 by CERT/CC (VU#102648), it was reported by researcher Maor Caplan and patched by maintainer Keichi Takahashi. It carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (CERT/CC Advisory, GitHub PR).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The binary-parser library dynamically generates and compiles JavaScript parser code at runtime using the Function constructor. User-supplied values — specifically parser field names and string encoding parameters — are directly interpolated into this generated code string without any validation or sanitization. An attacker who can influence these values (e.g., through an application that constructs parser definitions from external input) can inject arbitrary JavaScript that executes in the context of the Node.js process. Applications using only static, hardcoded parser definitions are not affected (CERT/CC Advisory, GitHub PR).

Successful exploitation allows an attacker to execute arbitrary JavaScript code with the privileges of the Node.js process, without requiring authentication, user interaction, or special privileges. Depending on the deployment environment, this could lead to unauthorized access to sensitive local data, manipulation of application logic, or execution of system commands. The network-accessible attack vector means remote exploitation is feasible wherever an application exposes binary-parser functionality to untrusted input (CERT/CC Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, CERT/CC Advisory).

1. Identify vulnerable applications: Locate Node.js applications that use binary-parser versions prior to 2.3.0 and accept externally controlled input that is passed into parser field names or encoding parameters (e.g., via API endpoints, file uploads, or configuration inputs).
2. Craft malicious input: Prepare a payload that injects JavaScript code into a parser field name or encoding parameter. For example, a field name like a"); require('child_process').exec('id'); // would break out of the generated code string and inject an arbitrary command.
3. Deliver the payload: Submit the crafted input to the vulnerable application through whatever interface accepts parser configuration — such as an HTTP request body, query parameter, or parsed binary data that influences parser construction.
4. Trigger parser compilation: Cause the application to invoke parser.parse() or parser.compile() with the malicious field name or encoding value, which causes the Function constructor to compile and execute the injected JavaScript.
5. Achieve code execution: The injected code runs in the context of the Node.js process, enabling data exfiltration, reverse shell establishment, or further lateral movement depending on process privileges (CERT/CC Advisory, GitHub PR).

• Logs: Node.js application logs showing unexpected errors or stack traces originating from dynamically generated Function constructor code; unusual JavaScript evaluation errors in parser-related code paths.
• Process: Unexpected child processes spawned by the Node.js process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Anomalous outbound connections from the Node.js server to unknown external IPs or domains, particularly shortly after binary data parsing operations.
• File System: Unexpected files written to disk by the Node.js process, such as web shells, scripts, or exfiltration staging files in application directories or temp folders.
• Application Behavior: Parser definitions being constructed from user-supplied input rather than static configurations; unusual encoding parameter values (e.g., containing semicolons, parentheses, or JavaScript keywords) appearing in application logs or request traces.

Upgrade the binary-parser npm package to version 2.3.0 or later, which implements input validation and mitigations for unsafe code generation in the Function constructor (GitHub PR, CERT/CC Advisory). As a workaround prior to patching, developers should ensure that parser field names and encoding parameters are never derived from untrusted or user-controlled input — only static, hardcoded values should be used. Network-facing applications using vulnerable versions should be prioritized for patching, and access to services using the vulnerable library should be restricted where possible until the upgrade is applied.

CERT/CC issued Vulnerability Note VU#102648 on January 20, 2026, warning of the issue and crediting researcher Maor Caplan for discovery (CERT/CC Advisory). The Hacker News covered the disclosure with the headline "CERT/CC Warns Binary-Parser Bug Allows Node.js Privilege-Level Code Execution," drawing broad community attention (The Hacker News). Security outlets including SecurityOnline, GBHackers, and CyberPress published coverage framing the issue as a supply chain risk for Node.js ecosystems. Community discussion on Reddit's r/SecOpsDaily and Mastodon (infosec.exchange) reflected moderate concern, particularly around the library's use in downstream npm packages.