What is the CVSS score of CVE-2026-32256?

CVE-2026-32256 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-32256?

A denial-of-service vulnerability in the music-metadata library can cause applications to hang indefinitely when processing maliciously crafted audio files.. A patch is available.

How to fix or mitigate CVE-2026-32256?

Within 24 hours: Identify all applications and services using music-metadata library and document their version numbers and deployment scope. Within 7 days: Implement input validation and file type restrictions to block untrusted ASF files; implement processing timeouts on all metadata parsing operations. Within 30 days: Monitor vendor repository for patch release; conduct threat modeling to assess exploitation likelihood in your environment; develop patching plan for rapid deployment once available.

Node.js CVE-2026-32256

HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-03-17 https://github.com/Borewit/music-metadata

GHSA-v6c2-xwv6-8xf7

Denial Of Service Node.js

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 20:04 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on music-metadata (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.12.3.

DescriptionGitHub Advisory

Summary

music-metadata's ASF parser (parseExtensionObject() in lib/asf/AsfParser.ts:112-158) enters an infinite loop when a sub-object inside the ASF Header Extension Object has objectSize = 0.

Root Cause

When objectSize is 0:

remaining = 0 - 24 = -24
tokenizer.ignore(-24) moves the read position backward by 24 bytes
extensionSize -= 0 (loop counter never decreases)
while (extensionSize > 0) never exits
The same 24-byte header is re-read infinitely

This is the same pattern as CVE-2026-31808 (GHSA-5v7r-6r5c-r473) in file-type - strtok3's AbstractTokenizer.ignore() accepts negative values without validation.

Affected Methods

parseFile() - HANGS (FileTokenizer inherits vulnerable ignore())
parseBuffer() - HANGS (BufferTokenizer inherits vulnerable ignore())
parseStream() - NOT affected (ReadStreamTokenizer has own ignore() that throws RangeError)