Skip to main content

CISA alerts on code injection in binary-parser library

Source Decision Insights Threat Desk Published January 20, 2026 Companies 2
Human View Machine View

2 companies named across 3 categories, one of 6 articles referencing Node.js. Previous coverage: CISA issues alert on NPM supply chain compromise involving credential theft and malware (Nov 2025).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Application / Software Development
Persona
Platform / Infrastructure Engineer
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

The binary-parser library for Node.js contains a code injection vulnerability that can enable execution of arbitrary JavaScript when parser definitions are constructed from untrusted input; the flaw affects versions prior to 2.3.0.

The issue is tracked as CVE-2026-1245 and involves binary-parser generating JavaScript at runtime via the Function constructor. The library inserts certain user-supplied values—specifically parser field names and encoding parameters—into that generated code without validation or sanitization. If an application supplies externally controlled data into those parameters, the unsanitized values can modify the produced code; applications that rely solely on static, hardcoded parser definitions are not affected.

When parser definitions are built from untrusted input in affected deployments, an attacker may execute arbitrary JavaScript with the privileges of the Node.js process. That capability can allow access to local data, manipulation of application logic, or execution of system commands depending on the deployment environment.

The vendor addressed the problem in version 2.3.0, implementing input validation and mitigations for unsafe code generation and clarifying the library’s design limitations. Users of binary-parser are advised to move to version 2.3.0 or later where the fix is included.

Users and developers are directed to upgrade to binary-parser version 2.3.0 or later and to avoid passing untrusted or user-controlled values into parser field names or encoding parameters; the vendor has published the fix and noted the library’s limitations in version 2.3.0.

Blog post, originally published by Timur Snoke at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-code-injection-in-binary-parser-library/",
        "name": "CISA alerts on code injection in binary-parser library",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-code-injection-in-binary-parser-library/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
      "name": "Node.js"
    },
    "articleSection": [
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Application / Software Development"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Platform / Infrastructure Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:10:54-06:00",
    "datePublished": "2026-01-20T14:25:00-07:00",
    "description": "binary-parser code injection allows arbitrary JavaScript when parser definitions use untrusted input; vendor fixed the issue in version 2.3.0.",
    "headline": "CISA alerts on code injection in binary-parser library",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Timur Snoke"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/102648"
    },
    "keywords": [
      "Application",
      "Node"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-code-injection-in-binary-parser-library/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
        "name": "Node.js"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Node.js"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages