CVE-2026-107392 · GHSA-8j4c-6x6g-rq3j
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
- Risk score
- 66/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negativ…
- Affected
- music-metadata (npm) <= 11.14.0
- Fix
- Upgrade music-metadata to 11.15.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
music-metadata: Amber, patch this week. music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negativ…
The flaws
- CVE-2026-107392: Uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7) (CVSS 7.5 · EPSS 0%)
- CVE-2026-107391: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master (CVSS 7.5 · EPSS 0%)
- CVE-2026-107390: Music-metadata is a metadata parser for audio and video media files (CVSS 7.5 · EPSS 0%)
- CVE-2026-107387: Uncontrolled memory allocation in APEv2 parser (CVSS 5.5 · EPSS 0%)
The fix
Upgrade music-metadata: 11.15.0 · 11.16.0 or later on your release line
Who is exposed: music-metadata (npm) <= 11.14.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-248 (CWE-248). 63 other warnings in 30 days
- Same product: Earlier music-metadata warnings. 2 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| music-metadata | npm | <= 11.14.0 | 11.15.0 |
References
- https://github.com/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
- https://github.com/advisories/GHSA-8j4c-6x6g-rq3j
Original description
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.