Read the docs
TI-2026-69683 Aliases CVE-2026-107389GHSA-5gfj-9q3v-qfp3

Excessive memory allocation in music-metadata EBML parser

Priority MEDIUM 61CWE-789Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

Versions of music-metadata before 11.16.0, a metadata parser for audio and video media files, are affected. Its Matroska and WebM EBML parser trusts an attacker-controlled element length for memory allocation before checking that the element fits its parent or the input (CWE-789). An attacker who supplies a crafted WebM, MKV, or MKA file can exhaust memory or, on Node.js, trigger an uncatchable fatal abort. A proof of concept is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed music-metadata (Borewit): 11.16.0music-metadata (npm): 11.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Borewitmusic-metadatabefore 11.16.011.16.0Patch availableCNA
—music-metadata (npm)before 11.16.011.16.0Patch availableGHSA-5gfj-9q3v-qfp3
  • music-metadata VendorBorewit Affected before 11.16.0 Fixed in 11.16.0 Patch available CNA
  • music-metadata (npm) Vendor— Affected before 11.16.0 Fixed in 11.16.0 Patch available GHSA-5gfj-9q3v-qfp3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*before 11.16.0VulnerableBorewit
  • cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:* Versions before 11.16.0 Vulnerable ·Borewit

Remediation

Upgrade the npm package music-metadata to version 11.16.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA music-metadata (Borewit) Fixed in 11.16.0
  • Fix · GHSA-5gfj-9q3v-qfp3 music-metadata (npm) Fixed in 11.16.0 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107389
  2. 2026-10-09 Alias added: GHSA-5gfj-9q3v-qfp3
  3. 2026-10-10 CISA SSVC decision points changed
  4. 2026-10-21 CVSS score added · NVD

References

Exploit 3

Patch 2

Other 1

  • TI-2026-69734 Memory exhaustion in music-metadata MP4 parser via oversized atom CVSS 3.1HIGH 7.5
  • TI-2026-69688 Unhandled rejection in music-metadata DSF parser crashes process CVSS 3.1HIGH 7.5
  • TI-2026-69697 Unvalidated ID3v2 tag size in music-metadata causes memory exhaustion CVSS 3.1MEDIUM 6.2
  • TI-2026-69681 Uncontrolled memory allocation in music-metadata APEv2 parser CVSS 3.1MEDIUM 6.2
  • TI-2026-24785 music-metadata has an infinite loop vulnerability in ASF parser CVSS 3.1HIGH 7.5
  • TI-2026-69694 Infinite loop in music-metadata MP4 parser causes denial of service CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences