Read the docs
TI-2026-69681 Aliases CVE-2026-107387GHSA-53v6-4h7p-p4gj

Uncontrolled memory allocation in music-metadata APEv2 parser

Priority MEDIUM 61CWE-789Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

music-metadata versions before 11.16.0 allocate memory for a binary APEv2 tag item based on its declared size before checking that the item fits in the remaining tag or file data (CWE-789). A small crafted APE file can trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. A proof-of-concept exploit is linked in the references. The demonstrated impact is availability loss only.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed music-metadata (Borewit): 11.16.0music-metadata (npm): 11.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Borewitmusic-metadatabefore 11.16.011.16.0Patch availableCNA
—music-metadata (npm)before 11.16.011.16.0Patch availableGHSA-53v6-4h7p-p4gj
  • music-metadata VendorBorewit Affected before 11.16.0 Fixed in 11.16.0 Patch available CNA
  • music-metadata (npm) Vendor— Affected before 11.16.0 Fixed in 11.16.0 Patch available GHSA-53v6-4h7p-p4gj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*before 11.16.0VulnerableBorewit
  • cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:* Versions before 11.16.0 Vulnerable ·Borewit

Remediation

Upgrade the npm package music-metadata to version 11.16.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA music-metadata (Borewit) Fixed in 11.16.0
  • Fix · GHSA-53v6-4h7p-p4gj music-metadata (npm) Fixed in 11.16.0 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107387
  2. 2026-10-09 Alias added: GHSA-53v6-4h7p-p4gj
  3. 2026-10-13 CVSS score added · NVD

References

Exploit 3

Patch 1

Other 1

  • TI-2026-69734 Memory exhaustion in music-metadata MP4 parser via oversized atom CVSS 3.1HIGH 7.5
  • TI-2026-69688 Unhandled rejection in music-metadata DSF parser crashes process CVSS 3.1HIGH 7.5
  • TI-2026-69697 Unvalidated ID3v2 tag size in music-metadata causes memory exhaustion CVSS 3.1MEDIUM 6.2
  • TI-2026-69683 Excessive memory allocation in music-metadata EBML parser CVSS 3.1MEDIUM 6.2
  • TI-2026-24785 music-metadata has an infinite loop vulnerability in ASF parser CVSS 3.1HIGH 7.5
  • TI-2026-69694 Infinite loop in music-metadata MP4 parser causes denial of service CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences