CVE-2026-1245 Code Injection in Node.js *binary-parser* via Dynamic Function Generation

A code-injection vulnerability in the Node.js npm package binary-parser can allow attackers to execute arbitrary JavaScript when applications build parser definitions from untrusted input. Tracked as CVE-2026-1245, the issue affects binary-parser versions < 2.3.0 and stems from the library’s use of dynamic code generation: it constructs JavaScript source at runtime and compiles it using the Function constructor for performance.

CERT/CC and third-party reporting indicate the flaw occurs because user-supplied values—notably parser field names and encoding parameters—can be incorporated into the generated code without sanitization, enabling attacker-controlled modification of the resulting executable parser logic. Impact depends on how the library is used: applications with static, hard-coded parser definitions are not affected, but implementations that allow external input to influence parser structure (e.g., user-defined parsing of uploaded content) may enable code execution with the privileges of the Node.js process; upgrading to 2.3.0 is the primary remediation, with patches noted as released November 26, 2025.