CVE-2026-107390

The music-metadata metadata parser for audio and video media files is vulnerable to memory exhaustion in versions prior to 11.16.0 . The MP4 parser fails to properly validate an attacker-controlled 64-bit extended atom size before converting it to a JavaScript Number and using it for payload pars...