Read the docs
TI-2026-69697 Aliases CVE-2026-107388GHSA-jjpr-9cvf-cq55

Unvalidated ID3v2 tag size in music-metadata causes memory exhaustion

Priority MEDIUM 61CWE-789Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

The npm package music-metadata before 11.16.0 is affected. The ID3v2 parser allocates the whole declared tag size before checking that the input holds those bytes (CWE-789). A local attacker supplying a truncated file with only an ID3v2 header can request an allocation approaching 268 MiB and exhaust memory, with no privileges or user interaction needed. A public proof-of-concept exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed music-metadata (Borewit): 11.16.0music-metadata (npm): 11.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Borewitmusic-metadatabefore 11.16.011.16.0Patch availableCNA
—music-metadata (npm)before 11.16.011.16.0Patch availableGHSA-jjpr-9cvf-cq55
  • music-metadata VendorBorewit Affected before 11.16.0 Fixed in 11.16.0 Patch available CNA
  • music-metadata (npm) Vendor— Affected before 11.16.0 Fixed in 11.16.0 Patch available GHSA-jjpr-9cvf-cq55

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*before 11.16.0VulnerableBorewit
  • cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:* Versions before 11.16.0 Vulnerable ·Borewit

Remediation

Upgrade the npm package music-metadata to version 11.16.0, which fixes this issue. Earlier versions remain affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA music-metadata (Borewit) Fixed in 11.16.0
  • Fix · GHSA-jjpr-9cvf-cq55 music-metadata (npm) Fixed in 11.16.0 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107388
  2. 2026-10-09 Alias added: GHSA-jjpr-9cvf-cq55
  3. 2026-10-10 Priority changed: MEDIUM → LOW
  4. 2026-10-13 CVSS score added · NVD
  5. 2026-10-14 CISA SSVC decision points changed
  6. 2026-10-14 Priority changed: LOW → MEDIUM

References

Exploit 2

Patch 2

Other 1

  • TI-2026-69734 Memory exhaustion in music-metadata MP4 parser via oversized atom CVSS 3.1HIGH 7.5
  • TI-2026-69688 Unhandled rejection in music-metadata DSF parser crashes process CVSS 3.1HIGH 7.5
  • TI-2026-69683 Excessive memory allocation in music-metadata EBML parser CVSS 3.1MEDIUM 6.2
  • TI-2026-69681 Uncontrolled memory allocation in music-metadata APEv2 parser CVSS 3.1MEDIUM 6.2
  • TI-2026-24785 music-metadata has an infinite loop vulnerability in ASF parser CVSS 3.1HIGH 7.5
  • TI-2026-69694 Infinite loop in music-metadata MP4 parser causes denial of service CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences