Unhandled rejection in music-metadata DSF parser crashes process
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
music-metadata before 11.15.0 is affected. Its DSF parser calls tokenizer.ignore without awaiting it and without rejecting chunks smaller than the 12-byte header, which causes an uncaught exception (CWE-248). A crafted DSF file makes the parse call produce an unhandled rejection that crashes the Node.js process, bypassing per-parse try/catch handling, and the impact is availability loss only. The references link a public exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Borewit | music-metadata | before 11.15.0 | 11.15.0 | Patch available | CNA |
| — | music-metadata (npm) | before 11.15.0 | 11.15.0 | Patch available | GHSA-8j4c-6x6g-rq3j |
- music-metadata VendorBorewit Affected before 11.15.0 Fixed in 11.15.0 Patch available CNA
- music-metadata (npm) Vendor— Affected before 11.15.0 Fixed in 11.15.0 Patch available GHSA-8j4c-6x6g-rq3j
Remediation
Upgrade the npm package music-metadata to 11.15.0, which is the fixed version. The sources list no fixed version for the Borewit music-metadata entry.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA music-metadata (Borewit) Fixed in 11.15.0
- Fix · GHSA-8j4c-6x6g-rq3j music-metadata (npm) Fixed in 11.15.0 Advisory →
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107392
- 2026-10-09 Alias added: GHSA-8j4c-6x6g-rq3j
- 2026-10-13 CVSS score added · NVD
- 2026-10-13 Priority changed: MEDIUM → HIGH
References
Patch 3
More Borewit Music-metadata vulnerabilities
- TI-2026-69734 Memory exhaustion in music-metadata MP4 parser via oversized atom CVSS 3.1HIGH 7.5
- TI-2026-69697 Unvalidated ID3v2 tag size in music-metadata causes memory exhaustion CVSS 3.1MEDIUM 6.2
- TI-2026-69683 Excessive memory allocation in music-metadata EBML parser CVSS 3.1MEDIUM 6.2
- TI-2026-69681 Uncontrolled memory allocation in music-metadata APEv2 parser CVSS 3.1MEDIUM 6.2
- TI-2026-24785 music-metadata has an infinite loop vulnerability in ASF parser CVSS 3.1HIGH 7.5
- TI-2026-69694 Infinite loop in music-metadata MP4 parser causes denial of service CVSS 3.1HIGH 7.5
Sources
- CVE-2026-107392 · CVE Program
- CVE-2026-107392 · NVD
- FIRST EPSS
- GHSA-8j4c-6x6g-rq3j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences