music-metadata CVE-2026-107389

Exploitation requires that the application pass attacker-controlled Matroska/WebM input (.webm, .mkv, or .mka) to music-metadata < 11.16.0 - this works against default configuration, no special feature flag needed, because the EBML VINT leaf-length validation is absent in all affected paths. No authentication is required (PR:N) and no user interaction beyond the application ingesting the file (UI:N). Severity-limiting factors: the worst outcome (uncatchable V8 fatal abort, exit code 133) is runtime- and API-dependent - it was reproduced only via parseFile on Node.js 26.7.0 and was NOT reproduced via parseBuffer on Node.js 20-25, where the flaw instead yields large allocation attempts or catchable errors. Impact is limited to availability only; there is no path to code execution, data disclosure, or integrity loss.

This is a genuine but moderate-severity availability issue, not a top-tier emergency. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2 Medium) scopes impact strictly to availability, which matches CWE-789 (memory allocation with excessive size value) and the description - no confidentiality or integrity impact is demonstrated. The key signal to scrutinize is the attack vector: the vendor chose AV:L, but music-metadata is a library most often used to parse untrusted, remotely-supplied media (uploaded .webm/.mkv/.mka files), which argues for a network vector in many real deployments - verify against your own data flow. EPSS score is NOT provided in the input and cannot be stated. KEV status is not listed (no CISA KEV entry), so there is no evidence of active exploitation. No POC=YES flag is provided, though the GHSA advisory documents the reporter's own reproducible demonstrations (34-byte→~128 MiB alloc, 70-byte→500 MiB, 48-byte→uncatchable V8 abort on Node 26.7.0). The signals are internally consistent: a high-availability-impact, low-complexity, unauthenticated DoS in a parser, with no exploitation-in-the-wild evidence. Real priority is driven by exposure - if you parse untrusted media server-side, patch promptly because the uncatchable V8 fatal abort (exit 133, survives try/catch) can crash a worker process deterministically; if you only parse trusted local files, this is lower urgency.

An attacker uploads a tiny crafted WebM/MKV/MKA file (as small as 34-70 bytes) to an application that uses music-metadata to extract audio/video metadata. The EBML parser reads the attacker-declared VINT leaf length and immediately allocates a string token or Uint8Array of that size - hundreds of MiB from a few bytes - causing out-of-memory denial of service; on Node.js 26.7.0 via parseFile, a declared 32 GiB leaf triggers an uncatchable V8 fatal abort that kills the process despite surrounding try/catch. The vendor advisory includes reproducible demonstrations of all three outcomes, but no standalone public exploit code is identified in the provided references.