---
id: CVE-2026-107390
title: music-metadata is a metadata parser for audio and video media files
summary: >-
  music-metadata is a metadata parser for audio and video media files. Prior to
  11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom
  size, converts it to a JavaScript Number, and uses the resulting payload
  length for…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-789
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:46:35.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107390'
references:
  - url: >-
      https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005
    label: security-advisories@github.com
  - url: 'https://github.com/Borewit/music-metadata/pull/2746'
    label: security-advisories@github.com
  - url: 'https://github.com/Borewit/music-metadata/releases/tag/v11.16.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Borewit/music-metadata/security/advisories/GHSA-qc8q-pw95-mq6c
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-08T21:07:56.433Z'
---

## Overview

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.