CVE-2026-1245

Executive Summary

CVE-2026-1245 is a code injection vulnerability (CWE-94) in the binary-parser library, a JavaScript/Node.js package used to parse binary data formats. The flaw affects all versions prior to 2.3.0 and allows unauthenticated or low-privilege attackers to achieve arbitrary JavaScript code execution within the Node.js process context when untrusted user input is passed into parser field names or encoding parameters. Because binary-parser is an open-source library, the actual affected deployments are downstream applications and services that embed this library and feed it with attacker-controllable data — the supply-chain impact could be substantial. No CISA KEV listing, public PoC, or exploitation-in-the-wild evidence has been reported; EPSS probability of exploitation is 0.515% (42nd percentile), indicating low but nonzero real-world exploitation likelihood.

Technical Analysis

The vulnerability resides in the code-generation mechanism of binary-parser. Based on the NVD description, the library does not parse binary data through a purely interpretive runtime engine — instead, it dynamically generates JavaScript code at runtime to construct the binary parsing logic (a common performance optimization in parser libraries). The key flaw is that two categories of user-controlled input — parser field names and encoding parameters — are interpolated directly into this dynamically generated code without any sanitization or escaping.

Vulnerability Mechanism:

1. Input Vector — Field Names: When an application defines a parser schema using binary-parser's fluent API and permits field names to originate from external input (e.g., database records, HTTP request parameters, configuration files, or user-supplied schemas), those parameters are concatenated into generated JavaScript source. A malicious field name such as }); require('child_process').exec('calc') // would break out of the generated code's string context and inject arbitrary JavaScript statements.

2. Input Vector — Encoding Parameters: Similarly, encoding options (character encodings such as utf8, ascii, hex, or custom encoding identifiers) can be passed to parser chain calls. If these values are attacker-controlled, they get embedded into generated code fragments (often within Buffer.toString(encoding) calls or similar internal operations), enabling the same injection path.

3. Execution: The dynamically assembled code string is subsequently executed — typically via eval(), new Function(), or vm module operations common in code-gen parser libraries. At that point, the injected payload executes with the full privileges of the Node.js process (e.g., filesystem access, network sockets, environment variables, and access to any secrets the process holds).

The vulnerability class is best described as "unsafe reflection of user input into dynamically evaluated code," closely related to server-side template injection (SSTI) and prototype pollution-adjacent code generation flaws. The pattern mirrors CWE-94 (Improper Control of Generation of Code, "Code Injection") and is sometimes labeled "Second-Order Code Injection" when the malicious input passes through a storage layer before triggering code generation.

The attack surface is defined by how the library is invoked — the library itself is not directly network-exposed; exposures occur in applications that:

• Process untrusted binary/blob data where schema definitions are partially or fully derived from user input.
• Offer "custom encoding" support to end users.
• Reflect API or query parameters into binary parsing configurations.
• Accept schemas defined in JSON or other markup from external clients.

Because the code executes inside Node.js, the impact is equivalent to Remote Code Execution (RCE) even though the vulnerability class is technically "code injection" — a full server- or application-level compromise is achievable.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification An attacker first identifies Node.js services or applications that embed binary-parser version < 2.3.0. This is typically achieved through:

• Checking public JavaScript source maps or bundled application JS for dependency identifiers (binary-parser strings).
• Observing server behavior when sending crafted binary payloads with unusual field-name or encoding inputs.
• Supply-chain reconnaissance: identifying organizations using affected versions of libraries that transitively depend on binary-parser.
• Fingerprinting error messages that leak stack traces or library internals when malformed schema input is submitted.

Step 2: Triggering the Flaw Class The attacker locates an endpoint where user-supplied data is used for:

• Schema definition: e.g., an API that accepts JSON describing fields to parse ("field name": "type").
• Encoding parameter selection.
• Any configuration interface that controls the structure of a binary parser.

The attacker then submits a deliberately malformed value crafted to break out of the string-interpolation context in the dynamically generated code.

Step 3: Payload / Execution Method (Class Level) The payload follows the generic code-injection pattern:

1. The injected value terminates the current code generation context (String, Array, or Function argument).
2. It appends a payload that composes JavaScript statements, typically using Node.js globals available in the generated code's scope.
3. The attacker commonly uses process.mainModule.require('child_process') to spawn system commands, or uses fs/http modules to exfiltrate data or establish a reverse shell.
4. After injection, the payload re-establishes a valid code context to prevent syntax errors that would abort parser compilation.

Step 4: Post-Exploitation

• System-level compromise: arbitrary command execution in the Node.js process user context.
• Data exfiltration: read of environment variables (API keys, database credentials), local files, or sensitive in-memory data.
• Lateral movement: If the process runs inside a container or Kubernetes pod, an attacker can pivot to other services using cloud metadata APIs (e.g., 169.254.169.254), service account tokens, or stored SSH keys.
• Persistence: modifier of application code or package files for persistent access.

No public PoC exists; the attack chain is inferred from vulnerability class and CWE-94 patterns observed in analogous code-generation parser vulnerabilities.

Impact Assessment

Technical Impact: Critical. The vulnerability enables arbitrary JavaScript code execution in the Node.js process context, which is equivalent to application-level RCE. An attacker who successfully exploits CVE-2026-1245 gains the same privileges as the Node.js process user, typically a service account with access to the application's configuration, secrets, data stores, and potentially the host (if running without container isolation).

Business Impact: Any application using binary-parser < 2.3.0 that reflects user input into parser schemas is at direct risk. This includes — but is not limited to — API gateways, financial data parsers, network protocol parsers (custom TCP/UDP services), IoT data ingestion platforms, and any Node.js service that converts untrusted structured data (JSON/XML/BSON) into binary-format parsing routines.

Blast Radius: Dependent on two conditions:

1. Deployment of the vulnerable library (all versions < 2.3.0).
2. Exposure of the affected input vectors.

If the parsing schema is fully hardcoded/fixed and not derived from user data, the library is effectively not exploitable. If user input is integrated into schema construction, full server compromise is achievable. Supply-chain risk is substantial: because binary-parser is an established npm package, downstream dependencies that use it may silently inherit the vulnerability. OSV reports list packages as "0→unfixed," indicating broad affected status.

CVSS Assessment: The official CVSS score is N/A because no scoring data was maintained by the CNA/NVD for this CVE. Based on the vulnerability characteristics (code injection → RCE), a reasonable CVSS v3.1 qualitative assessment would align with a critical (9.0–10.0) score — however, per strict data fidelity requirements, the exact published score remains N/A and no alternate scoring is assumed.

Exploitation Probability: EPSS score of 0.00515 (42nd percentile) indicates that exploitation is currently not widespread; however, because no PoC has been published, active exploitation is likely limited to skilled attackers or those with private exploit development capability.

Detection Guidance

The detection rules below target the specific vulnerable input patterns that would indicate an attempt to achieve code injection through field-name or encoding-parameter manipulation. Since exploitation happens server-side during dynamic code generation, network detection focuses on anomalous payload structures embedded in request parameters. Host-level detection monitors Node.js process behavior (code execution, child process spawning).

Sigma Rule

title: Binary-Parser Code Injection Attempt via Unusual Field Encodings
id: 5c67a44c-2b19-4a0d-90f2-1c3e0d5b0b4a
status: experimental
description: Detects requests containing suspicious JavaScript code injection patterns in parameters that could be mapped to binary-parser field names or encoding parameters
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: generic
detection:
  selection_php:
    cs-method: POST|GET|PUT
    cs-uri-query|contains:
      - 'new Function'
      - 'eval('
      - 'child_process'
      - 'require('
      - 'process.mainModule'
      - 'Function('
      - '${'
      - '});'
  selection_encoding:
    cs-uri-query|contains:
      - 'encoding='
      - 'field='
      - 'schema='
      - 'format='
    cs-uri-query|contains:
      - '%27'
      - "'"
      - '${'
      - ';'
  condition: selection_php AND selection_encoding
  timeframe: 5m
falsepositives:
  - Legitimate use of JavaScript code as parameters in developer tooling or debugging endpoints
level: high
tags:
  - attack.t1203
  - attack.t1190
  - cve.2026-1245

YARA Rule

rule BinaryParser_CodeInjection_Payloads {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payload patterns targeting CVE-2026-1245 code injection in binary-parser library"
        cve = "CVE-2026-1245"
        reference = "NVD CVE-2026-1245"
        date = "2026-02-15"
        severity = "high"
    strings:
        $s1 = "child_process" ascii wide
        $s2 = "process.mainModule" ascii wide
        $s3 = "require('child_process')" ascii wide
        $s4 = "require(\"child_process\")" ascii wide
        $s5 = "new Function(" ascii wide
        $s6 = "eval(" ascii wide
        $s7 = "global.process" ascii wide
        $s8 = "Buffer.from" ascii wide
        $s9 = "encoding" ascii wide
        $s10 = "utf8" ascii wide
        $s11 = "hex" ascii wide
        $s12 = "});" ascii wide
        $s13 = "Function(" ascii wide
    condition:
        // Context: combined payload with encoding references and js execution primitives
        2 of ($s1,$s2,$s3,$s4,$s5,$s6,$s7,$s13) and
        (1 of ($s8,$s9,$s10,$s11)) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-1245 Binary-Parser Code Injection Attempt"; 
flow:established,to_server; 
content:"child_process"; nocase; 
content:"require"; http_uri; nocase; 
content:"encoding"; http_uri; nocase; 
pcre:"/(?:Function|eval|require|process\.mainModule)/Ui"; 
classtype:attempted-admin; 
sid:9011245; rev:1; 
reference:cve,2026-1245; 
metadata:created_at 2026_02_15, updated_at 2026_02_15;)

Elastic Detection

// Requires: Elastic Defend/Endpoint or Auditbeat with process and network event logging
sequence by process.entity_id
  [network where process.name : "node" and 
     event.action == "connection_attempted" and destination.port == 80 or destination.port == 443]
  [process where event.type == "start" and 
     process.parent.name : "node" and 
     process.name : ("sh", "bash", "cmd.exe", "powershell.exe", "curl", "wget", "nc")]

Splunk SPL Query

index=* sourcetype=* 
  (sourcetype="iis" OR sourcetype="apache" OR sourcetype="access_combined")
  (("child_process" OR "require(" OR "new Function" OR "eval(") 
  AND ("encoding=" OR "field=" OR "schema=" OR "format="))
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri_path, status, user_agent
| where count > 5
| table firstTime lastTime src_ip uri_path status count user_agent
| sort - count

Wazuh OSSEC Rule

<group name="nodejs,binary-parser,code-injection,">
  <rule id="101245" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(GET|POST|PUT)</field>
    <match>child_process|process\.mainModule|new Function|eval\(</match>
    <regex>encoding=|field=|schema=|format=</regex>
    <description>CVE-2026-1245 Binary-Parser code injection attempt detected in HTTP request</description>
    <group>attack.t1203,attack.t1190,cve-2026-1245,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources (CNA and OSV) confirm fix existence).

1) Immediate Mitigations (until patched)

• Upgrade priority: If your application uses binary-parser and exposes any functionality where user-controlled input (HTTP parameters, JSON bodies, DB-stored schema values, uploaded configuration files) can influence parser field names or encoding parameters, treat this as an emergency patching priority even without a public PoC.
• Input validation: Implement strict allowlists at the application boundary:
  • Enforce that field names match ^[a-zA-Z_][a-zA-Z0-9_]*$ (valid identifier-safe characters only).
  • Enforce encoding parameters against an explicit enumerated list (utf8, ascii, utf16le, ucs2, base64, latin1, binary, hex).
  • Reject any payloads containing ;, }, ${, quotes (' or "), or JavaScript keywords in schema values.
• No user-controlled schemas: If achievable in the short term, disable any feature allowing remote schema definition or modification. Hardcode all parsing schemas server-side.
• Network-level containment: If the vulnerable application is internet-facing, apply egress restrictions at the firewall/WAF level to block outbound connections from the Node.js process (limit exfiltration capability if a compromise occurs).

2) Patch / Upgrade Steps

• Upgrade binary-parser to version 2.3.0 or later as soon as the patched release is confirmed available. Verify the update using the package registry (npm) or the project's release channel.
• Audit all downstream dependencies: run npm audit or yarn audit and inspect the dependency tree for any package that transitively depends on binary-parser:

  npm ls binary-parser
  

  For each vulnerable leaf, determine if it is used in a context where the vulnerable input vectors are reachable. If not directly exploitable, prioritize upgrade nonetheless to eliminate attack surface.
• Verify the patched version does not break existing parsing functionality via regression tests, as parser internals may have been rewritten.

3) Long-Term Hardening

• Mandatory code audits: Onboard CodeQL or Semgrep static application security testing (SAST) rules targeting:
  • Dynamic code generation patterns (eval, new Function, vm.runInNewContext).
  • String concatenation into executable code contexts.
  • Reflection of user input into parser/decoder configuration.
• Supply chain hygiene: Implement automated dependency vulnerability scanning (Snyk, OSV-Scanner, Dependabot) that fails CI/CD builds when CVEs with CWE-94 + code execution potential are identified.
• Runtime hardening:
  • Run Node.js services under a non-root service account with minimal filesystem permissions.
  • Employ container isolation with read-only root filesystem and no CAP_SYS_ADMIN.
  • Set NODE_OPTIONS=--disallow-code-generation-from-strings as a defense-in-depth measure (this blocks eval / new Function usage at runtime, though may break legitimate code-gen parsers — test impact first).
• WAF rules: Deploy virtual-patching WAF rules (ModSecurity CRS or cloud WAF) that block the payload signatures identified in the detection rules above (function keywords + encoding parameter context).
• Monitoring: Enable comprehensive audit logging for all Node.js processes with process.spawn / child_process event detection to identify post-exploitation behavior.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-1245 — National Vulnerability Database authoritative CVE record (NVD description used as primary data source for this report).
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-1245 — Open Source Vulnerability database entry; confirms affected package status ("0→unfixed") and independent patch confirmation.
3. CWE-94 Reference: https://cwe.mitre.org/data/definitions/94.html — Weakness definition: Improper Control of Generation of Code ('Code Injection'); provides class-level technical context for the vulnerability mechanism.
4. EPSS Data: https://www.first.org/epss/ — Exploit Prediction Scoring System; score 0.00515 (42.0% percentile) consulted for exploitation-likelihood context.

Threat Actor / Exploitation in the Wild Status: As of the publication date of this report, there are no documented threat-actor campaigns exploiting CVE-2026-1245, no CISA KEV (Known Exploited Vulnerabilities) listing, and no public exploit code or PoC. Exploitation likelihood remains low but should be re-assessed continuously, particularly as security research communities analyze the patched diff (version 2.3.0) which will likely produce a working PoC shortly after patch disclosure.