music-metadata has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.2 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-789 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files34CVE-2026-107391Medium· 6.2music-metadata is a metadata parser for audio and video media files34CVE-2026-107389Medium· 6.2music-metadata is a metadata parser for audio and video media files34CVE-2026-107388Medium· 6.2music-metadata is a metadata parser for audio and video media files34CVE-2026-107387Medium· 6.2music-metadata is a metadata parser for audio and video media files34
music-metadata vulnerabilities
CVEs affecting music-metadata, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk siz…
CVE-2026-107391Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sam…
CVE-2026-107389Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before conf…
CVE-2026-107388Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes.…
CVE-2026-107387Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in…