Executive brief
The binary-parser library is a JavaScript library used to parse binary data in Node.js applications. A code injection vulnerability allows attackers to execute arbitrary JavaScript code if the library processes untrusted input in parser field names or encoding parameters. This can lead to complete compromise of any application using the library with untrusted data.
Technical details
The vulnerability is a code injection flaw (CWE-94) in binary-parser versions before 2.3.0, where user-supplied values in parser field names and encoding parameters are directly interpolated into dynamically generated JavaScript code without sanitization. An attacker who can control field names or encoding parameters in parser configuration can inject arbitrary JavaScript code that executes in the Node.js process context with the same privileges as the application. The attack requires network access if the parser is used to process remote data, and no authentication is required. The vulnerability was fixed in version 2.3.0 via pull request #283, which added proper input sanitization.
Affected products
- keichi binary-parser < 2.3.0
Timeline
- 2026-01-20: disclosed
- 2026-01-20: patched: Fix merged to master on 2025-11-26, version 2.3.0 released