Loading vulnerability…
Code Injection in binary-parser
CVE-2026-1245 is a code injection vulnerability in the Node.js binary-parser library affecting versions prior to 2.3.0. The flaw arises from unsafe dynamic code generation: the library constructs JavaScript parser logic at runtime using the Function constructor and directly interpolates user-controlled values, including parser field names and encoding parameters, into the generated source without adequate sanitization or validation. When an application builds parser definitions from untrusted input, an attacker can manipulate those values so that the generated parser contains attacker-supplied JavaScript, which is then compiled and executed in the context of the hosting Node.js process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution with the privileges of the vulnerable Node.js process. Depending on the application's permissions and deployment model, this can enable remote code execution, access to local application data, manipulation of application logic, and execution of operating-system commands. In higher-privilege or network-connected environments, compromise of the process may also facilitate broader post-exploitation activity.
If you can’t patch tonight, do this now.
Until patching is complete, avoid constructing parser definitions from untrusted input. Do not allow user-controlled values to populate parser field names or encoding parameters. Enforce strict allowlists for permitted identifiers and encodings, validate and sanitize any dynamic configuration before it reaches binary-parser, and prefer static, hardcoded parser definitions wherever possible.
Patch, then assume compromise.
Upgrade binary-parser to version 2.3.0 or later, which contains the vendor's fix for the unsafe handling of dynamic parser code generation. Review application code for any use of externally sourced or user-controlled values in parser definitions, especially field names and encoding parameters, and refactor those paths so parser structure is not derived directly from untrusted input.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.