EUVD-2026-95248
GHSA-8j4c-6x6g-rq3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted .dsf to audio-parsing app
-
ExploitDSF parser reads undersized chunk header
-
ExecutionUn-awaited tokenizer.ignore() throws negative-length RangeError
-
ImpactUnhandled promise rejection crashes Node process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | The deploying application must parse attacker-supplied audio with music-metadata < 11.15.0, and the input must reach the DSF parsing path - i.e. a file carrying the 'DSD ' magic. The crafted file needs a chunk with id other than 'fmt ' and a size field between 0 and 11 (smaller than the 12-byte ChunkHeader), producing a negative ignore length. The crash additionally requires strtok3 >= 10.3.5 (which throws RangeError on negative ignore) and Node.js >= 15 default behavior (unhandled rejection terminates the process). No authentication or user interaction is required (PR:N/UI:N). Limiting factors: the app must actually ingest untrusted audio and invoke the DSF code path, and downgrading strtok3 below 10.3.5 or overriding Node's unhandledRejection handler would blunt the uncatchable crash - though the underlying parse error remains. |
| Impact | Signals are internally consistent and point to a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, score 7.5) describes a network-reachable, low-complexity, unauthenticated availability-only impact, which matches the advisory: a single crafted .dsf file crashes the Node process. SSVC corroborates this as Exploitation=poc, Automatable=no, Technical Impact=partial - the 'no' on automatable and 'partial' impact align with a DoS that requires an app to actually route untrusted audio through the DSF path rather than a wormable mass-exploit. EPSS is low (0.20%, 9th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of widespread or active exploitation - consistent with a crash bug that yields no code execution or data access (C:N/I:N). The notable aggravating factor is reach and uncatchability: music-metadata has ~2.2M weekly npm downloads and the missing await turns the RangeError into an unhandled rejection that bypasses a caller's per-parse try/catch, so even defensively coded apps are taken down. Net: a legitimate patch-worthy availability issue for any service parsing untrusted audio, but not an emergency - no RCE, no active exploitation, low EPSS. Priority should be driven by whether the deploying app actually ingests untrusted DSF/DSD files. |
| Exploit ScenarioDerived | An attacker uploads a crafted .dsf (or any file with the 'DSD ' magic) to a web service or worker that extracts audio metadata with music-metadata. A proof-of-concept reproducer is published in the vendor repo. The malformed chunk (id != 'fmt ', size 0..11) triggers a negative ignore length; the un-awaited call throws a RangeError as an unhandled rejection that crashes the Node process even though parseBuffer appeared to resolve, taking down a shared server or worker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Earlier versions of this analysis (1)
Denial of service in music-metadata 11.14.0 and earlier allows an unauthenticated attacker who can supply a crafted DSF file to crash the Node.js process parsing it; CVSS 3.1 score 6.2 (AV:L/AC:L/PR:N/UI:N, availability-only). The crash occurs when an unrecognized DSF chunk declares a size smaller than the 12-byte chunk header, producing a negative tokenizer ignore length whose RangeError becomes an unhandled rejection after the parse promise has already resolved, bypassing caller try/catch. A publicly available proof-of-concept/repro exists (public exploit code exists), but no KEV active exploitation is noted in the provided data; the issue is fixed in 11.15.0.
RemediationAI
Vendor-released patch: 11.15.0 - upgrade music-metadata to 11.15.0 or later, which adds await to the ignore call (making the RangeError a catchable parse error) and validates chunkHeader.size >= ChunkHeader.len before skipping, plus additional DSF container validation (DSD chunk size, file size, and metadata pointer bounds); see the advisory at https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j, the fix PR at https://github.com/Borewit/music-metadata/pull/2700, the commit https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41, and the release https://github.com/Borewit/music-metadata/releases/tag/v11.15.0. If upgrading immediately is not possible, the most effective compensating control is to pin strtok3 below 10.3.5, which prevents the RangeError from being thrown and therefore blunts the uncatchable crash - the trade-off is that it forgoes strtok3's own hardening and leaves the malformed parse itself unaddressed, so this should be treated as temporary. A second option is to install a process-level 'unhandledRejection' handler (or run parsing in a disposable child process/worker that is restarted on exit); the trade-off is that a global handler can mask other latent defects and a worker-per-file model adds CPU and memory overhead. Where untrusted media is not essential, restricting or blocking uploads of DSF/DSD files (files beginning with the 'DSD ' magic) at the ingestion boundary removes the vulnerable code path entirely, at the cost of losing legitimate DSD support. Note that try/catch around the parse call is explicitly not a mitigation for this defect, since the rejection is detached from the resolved parse promise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an uncaught-exception class issue (CWE-248) in the DSF container parser of music-metadata (CPE cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*). In DsfParser.parseChunks (lib/dsf/DsfParser.ts), the loop reads a 12-byte ChunkHeader ({ id, size }) and, for any chunk whose id is not 'fmt ', skips the payload with this.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len) - with no await, and with no validation that size >= 12. A crafted chunk carrying size in 0..11 therefore produces a negative ignore length; strtok3 10.3.5 and later throws RangeError('ignore length must be ≥ 0 bytes') from AbstractTokenizer.ignore. Because the call is fire-and-forget, that rejection is no longer chained to the parseBuffer() promise: it surfaces as an unhandled rejection, and under Node.js 15+ default behavior an unhandled rejection terminates the process. The parse promise has already settled successfully by then, which is why try/catch around the parse call provides no protection. This is a residual of GHSA-v6c2-xwv6-8xf7: the ASF parsing site received size validation in 11.12.3, and strtok3 was hardened to throw on negative ignore, but the DSF site was never validated and its missing await escalated the throw into an uncatchable crash. The crash path therefore depends on three conditions stacking: an input with the 'DSD ' magic reaching the DSF parser, strtok3 >= 10.3.5, and Node.js >= 15 default rejection handling.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A crafted file supplied over the network to an unauthenticated upload/parse path reliably crashes the process, so AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.
Blast Radius
ecosystem impact- 2 npm packages depend on music-metadata (1 direct, 1 indirect)
Ecosystem-wide dependent count for version 11.15.0.
Executive ViewAI
Organizations that use the music-metadata npm package to process audio files face an availability risk because a malicious file can terminate the underlying Node.js service, interrupting media ingestion, customer-facing uploads, or batch processing. Publicly available exploit code exists, but there is no evidence of active exploitation and the CVE is not in CISA KEV. Leadership should care because a single malformed upload may cause an outage until the process restarts, while a vendor patch is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB