Vulnerability · Published Jan 20, 2026 · Assigned by certcc
CVE-2026-1245CVE-2026-1245
Medium 6.5
In plain English
A medium-severity security flaw in binary-parser from binary-parser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | binary-parser | 2.3.0 | GHSA-m39p-34qh-rh3w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| binary-parser | binary-parser | 0 – before 2.3.0 |