CVE-2026-107390

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...

CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107392

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107389

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107390 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107390 Source advisory: SNYK:JS-MUSICMETADATA-20877459...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the MP4 atom parser in lib/mp4/Atom.ts, where atom header sizes are not validated before...

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

GHSA-F94X-6692-553Q music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107391 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107391 Source advisory: SNYK:JS-MUSICMETADATA-20877454...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107391 +1 more via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107391, CVE-2026-32256 Source advisory: GHSA-F94X-6692-553Q...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107391 +1 more via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107391, CVE-2026-32256 Source advisory: OSV:GHSA-F94X-6692-553Q...

Infinite loop

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Infinite loop via the StsdAtom.get method in lib/mp4/AtomToken.ts when parsing MP4 files. The method iterates over stsd sample entries...

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser

NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

GHSA-53V6-4H7P-P4GJ music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

music-metadata: Uncontrolled memory allocation in APEv2 parser

Summary music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser. The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape fi...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +13 more potentially affected by CVE-2026-107387 via music-metadata (>=11.0.0, <=11.12.3)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =2026.5.39, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =1.0.44, =1.0.18, =1.0.19 - malvin-baileys 2.2.4 - tagtoname 6.0.1 Source cves: CVE-2026-107387 Source advisory: GHSA-53V6-4H7P-P4GJ...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107387 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107387 Source advisory: OSV:GHSA-53V6-4H7P-P4GJ...

@actagent/matrix (>=2026.6.2, <=2026.6.5), @dada78641/tunetags (0.1.1) +22 more potentially affected by CVE-2026-107387 via music-metadata (>=11.0.0, <=11.15.0)

music-metadata NPM version =11.0.0, =2026.6.2, =2.0.1, =0.17.4, =2026.5.39, =0.6.0, =2.0.3, =2026.5.12-beta.1, =1.0.0, =6.7.4, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-107387 Source advisory: SNYK:JS-MUSICMETADATA-20877456...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the APEv2 tag parser in APEv2Parser.ts, where a malicious audio file can specify an...