Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107387 · GHSA-53v6-4h7p-p4gj

music-metadata: Uncontrolled memory allocation in APEv2 parser

Risk score
45/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a …
Affected
music-metadata (npm) <= 11.12.3
Fix
Upgrade music-metadata to 11.16.0 or later.
Exploitation
Public proof of concept

Story map

Story map: music-metadataTHE FLAWSTHE FIXCVE-2026-107387Uncontrolled memory allocationin APEv2 parserCVSS 5.5 · EPSS 0%CVE-2026-107392Uncatchable process crashparsing a crafted `.dsf`(residual of…CVSS 7.5 · EPSS 0%CVE-2026-107391MP4 stsd sample-entrysize==0 causes a synchronousinfinite loop (DoS) — unreleased…CVSS 7.5 · EPSS 0%CVE-2026-107390Music-metadata is a metadataparser for audio and videomedia filesCVSS 7.5 · EPSS 0%Upgrade music-metadata11.16.0 · 11.15.0or later on your release lineWho is exposedmusic-metadata (npm) <= 11.14.0AMBER · PATCH THIS WEEKmusic-metadatamusic-metadata is a metadataparser for audio and video mediafiles. Prior to 11.15.0, the DSFparser handles an unrecognizedchunk by calling tokenizer.ignorewithout awaiting the returnedpromise and without first…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-789 (CWE-789)45 other warnings in 30 days →Same productEarlier music-metadata warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

music-metadata: Amber, patch this week. music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negativ…

The flaws

  • CVE-2026-107387: Uncontrolled memory allocation in APEv2 parser (CVSS 5.5 · EPSS 0%)
  • CVE-2026-107392: Uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7) (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107391: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master (CVSS 7.5 · EPSS 0%)
  • CVE-2026-107390: Music-metadata is a metadata parser for audio and video media files (CVSS 7.5 · EPSS 0%)

The fix

Upgrade music-metadata: 11.16.0 · 11.15.0 or later on your release line

Who is exposed: music-metadata (npm) <= 11.14.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
music-metadatanpm<= 11.12.311.16.0

References

Original description

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.