CVE-2026-107390

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...

CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107392

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107389

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

GHSA-F94X-6692-553Q music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +21 more potentially affected by CVE-2026-107391 +1 more via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107391, CVE-2026-32256 Source advisory: GHSA-F94X-6692-553Q...

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +21 more potentially affected by CVE-2026-107391 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107391 Source advisory: OSV:GHSA-F94X-6692-553Q...

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +13 more potentially affected by CVE-2026-107387 via music-metadata (>=11.0.0, <=11.12.3)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =2026.5.39, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =1.0.44, =1.0.18, =1.0.19 - malvin-baileys 2.2.4 - tagtoname 6.0.1 Source cves: CVE-2026-107387 Source advisory: GHSA-53V6-4H7P-P4GJ...

music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

GHSA-53V6-4H7P-P4GJ music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +21 more potentially affected by CVE-2026-107387 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107387 Source advisory: OSV:GHSA-53V6-4H7P-P4GJ...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +13 more potentially affected by CVE-2026-107388 via music-metadata (>=11.0.0, <=11.12.3)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =2026.5.39, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =1.0.44, =1.0.18, =1.0.19 - malvin-baileys 2.2.4 - tagtoname 6.0.1 Source cves: CVE-2026-107388 Source advisory: GHSA-JJPR-9CVF-CQ55...

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

GHSA-JJPR-9CVF-CQ55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +21 more potentially affected by CVE-2026-107388 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107388 Source advisory: OSV:GHSA-JJPR-9CVF-CQ55...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +21 more potentially affected by CVE-2026-107389 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107389 Source advisory: OSV:GHSA-5GFJ-9Q3V-QFP3...