CVE-2026-107391Medium· 6.2▾ Sunlitmusic-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sam…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
music-metadata < 11.16.0Patched in:
music-metadata 11.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107389Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107387Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107388Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-101895HighAngular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
CVE-2021-37136High· 7.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)