Read the docs
TI-2026-69694 Aliases CVE-2026-107391GHSA-f94x-6692-553q

Infinite loop in music-metadata MP4 parser causes denial of service

Priority LOW 33CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

music-metadata, a parser for audio and video media files, is affected before 11.16.0. Its MP4 sample-description parser accepts a sample entry with size zero, so its loop never ends (CWE-835). An unauthenticated remote attacker can supply a crafted MP4 file that blocks the Node.js event loop and grows memory until the process is terminated. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed music-metadata (Borewit): 11.16.0music-metadata (npm): 11.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Borewitmusic-metadatabefore 11.16.011.16.0Patch availableCNA
—music-metadata (npm)before 11.16.011.16.0Patch availableGHSA-f94x-6692-553q
  • music-metadata VendorBorewit Affected before 11.16.0 Fixed in 11.16.0 Patch available CNA
  • music-metadata (npm) Vendor— Affected before 11.16.0 Fixed in 11.16.0 Patch available GHSA-f94x-6692-553q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*11.14.0 to before 11.16.0VulnerableBorewit
  • cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:* Versions 11.14.0 to before 11.16.0 Vulnerable ·Borewit

Remediation

Upgrade music-metadata to version 11.16.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA music-metadata (Borewit) Fixed in 11.16.0
  • Fix · GHSA-f94x-6692-553q music-metadata (npm) Fixed in 11.16.0 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107391
  2. 2026-10-09 Alias added: GHSA-f94x-6692-553q
  3. 2026-10-10 CISA SSVC decision points changed
  4. 2026-10-10 Priority changed: MEDIUM → LOW
  5. 2026-10-13 CVSS score added · NVD

References

Exploit 3

Patch 1

Other 1

  • TI-2026-69734 Memory exhaustion in music-metadata MP4 parser via oversized atom CVSS 3.1HIGH 7.5
  • TI-2026-69688 Unhandled rejection in music-metadata DSF parser crashes process CVSS 3.1HIGH 7.5
  • TI-2026-69697 Unvalidated ID3v2 tag size in music-metadata causes memory exhaustion CVSS 3.1MEDIUM 6.2
  • TI-2026-69683 Excessive memory allocation in music-metadata EBML parser CVSS 3.1MEDIUM 6.2
  • TI-2026-69681 Uncontrolled memory allocation in music-metadata APEv2 parser CVSS 3.1MEDIUM 6.2
  • TI-2026-24785 music-metadata has an infinite loop vulnerability in ASF parser CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences