Music Metadata
Monthly
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Unbounded synchronous looping in the unreleased music-metadata master-branch MP4 'stsd' sample-description parser lets a crafted 48-byte MP4-family file pin the Node.js event loop at ~100% CPU while an in-memory sample-description table grows until the process is killed externally or exhausts memory. The regression was introduced after 11.14.0 by commit d2a7d6f (PR #2693, which changed the cursor advance to 'off += size - 4' without guarding for small sizes) and exists only on the public master branch - no published npm release, including 11.14.0 and earlier, contains the vulnerable change, and 11.16.0 ships the fix. Exploitation requires an application that parses attacker-supplied MP4-family input through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (no authentication, no user interaction, availability-only impact), no public exploit targeting released versions was identified at time of analysis, and the practical limiting factor for defenders is install method (git/master build versus npm release) rather than configuration.
Denial of service in music-metadata versions prior to 11.16.0 lets remote attackers crash or exhaust memory in any application that parses an attacker-supplied MP4-family file. The MP4 atom parser trusts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and passes the oversized length into atom-specific readToken payload parsing (mvhd, stsd, stsz, or date) before confirming the atom fits within its parent or the remaining input, so a tiny crafted file can force a large allocation attempt or process failure. The flaw is remotely triggerable without authentication and without user interaction beyond the file being processed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); publicly available exploit code exists, but there is no evidence of active exploitation, no KEV listing, and EPSS is low at 0.13% (2nd percentile), with impact confined to availability.
Denial of service in the npm package music-metadata before 11.16.0 lets unauthenticated remote attackers crash or exhaust memory in any application that parses untrusted Matroska, WebM, or MKA input - a 34-byte file can trigger an ~128 MiB allocation, a 70-byte file a 500 MiB allocation, and (demonstrated only via the parseFile API on Node.js 26.7.0) a 48-byte file an uncatchable V8 fatal abort that exits with code 133. The flaw carries availability impact only and is remotely reachable with no authentication and no user interaction beyond the application ingesting the file (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; the originally reported score of 6.2 used an AV:L vector). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the upstream advisory documents minimal crafted inputs that deterministically reproduce the allocation behavior, so deployment of the fixed version is the priority for anything that accepts user-supplied media.
Uncontrolled memory allocation in the music-metadata Node.js library (versions prior to 11.16.0) lets an attacker who supplies a truncated ID3v2 audio file force the parser to reserve up to ~268 MiB based on a header that declares a large tag body which is not actually present. The parser allocates the full declared size before confirming those bytes exist, then silently catches the resulting EndOfStreamError and returns a normal metadata object, so the failure is invisible to the calling application. Impact is limited to availability (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L): each crafted file produces a bounded, transient allocation that is freed once the read fails, so meaningful denial of service requires high volume or concurrency; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 11.16.0.
Parsing a crafted APEv2 tag with the music-metadata library before 11.16.0 can force a disproportionate Uint8Array allocation from an attacker-controlled tag-item size field, and repeated or concurrent parsing of such files can exhaust the host process's memory. The flaw is reachable by any Node.js application, service, or bundled front end that hands attacker-supplied .ape/MP3-with-APEv2 media to the parser; it is fixed in 11.16.0. The demonstrated impact is availability loss only - the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.2) with no confidentiality or integrity effect, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Unbounded synchronous looping in the unreleased music-metadata master-branch MP4 'stsd' sample-description parser lets a crafted 48-byte MP4-family file pin the Node.js event loop at ~100% CPU while an in-memory sample-description table grows until the process is killed externally or exhausts memory. The regression was introduced after 11.14.0 by commit d2a7d6f (PR #2693, which changed the cursor advance to 'off += size - 4' without guarding for small sizes) and exists only on the public master branch - no published npm release, including 11.14.0 and earlier, contains the vulnerable change, and 11.16.0 ships the fix. Exploitation requires an application that parses attacker-supplied MP4-family input through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (no authentication, no user interaction, availability-only impact), no public exploit targeting released versions was identified at time of analysis, and the practical limiting factor for defenders is install method (git/master build versus npm release) rather than configuration.
Denial of service in music-metadata versions prior to 11.16.0 lets remote attackers crash or exhaust memory in any application that parses an attacker-supplied MP4-family file. The MP4 atom parser trusts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and passes the oversized length into atom-specific readToken payload parsing (mvhd, stsd, stsz, or date) before confirming the atom fits within its parent or the remaining input, so a tiny crafted file can force a large allocation attempt or process failure. The flaw is remotely triggerable without authentication and without user interaction beyond the file being processed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); publicly available exploit code exists, but there is no evidence of active exploitation, no KEV listing, and EPSS is low at 0.13% (2nd percentile), with impact confined to availability.
Denial of service in the npm package music-metadata before 11.16.0 lets unauthenticated remote attackers crash or exhaust memory in any application that parses untrusted Matroska, WebM, or MKA input - a 34-byte file can trigger an ~128 MiB allocation, a 70-byte file a 500 MiB allocation, and (demonstrated only via the parseFile API on Node.js 26.7.0) a 48-byte file an uncatchable V8 fatal abort that exits with code 133. The flaw carries availability impact only and is remotely reachable with no authentication and no user interaction beyond the application ingesting the file (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; the originally reported score of 6.2 used an AV:L vector). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the upstream advisory documents minimal crafted inputs that deterministically reproduce the allocation behavior, so deployment of the fixed version is the priority for anything that accepts user-supplied media.
Uncontrolled memory allocation in the music-metadata Node.js library (versions prior to 11.16.0) lets an attacker who supplies a truncated ID3v2 audio file force the parser to reserve up to ~268 MiB based on a header that declares a large tag body which is not actually present. The parser allocates the full declared size before confirming those bytes exist, then silently catches the resulting EndOfStreamError and returns a normal metadata object, so the failure is invisible to the calling application. Impact is limited to availability (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L): each crafted file produces a bounded, transient allocation that is freed once the read fails, so meaningful denial of service requires high volume or concurrency; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 11.16.0.
Parsing a crafted APEv2 tag with the music-metadata library before 11.16.0 can force a disproportionate Uint8Array allocation from an attacker-controlled tag-item size field, and repeated or concurrent parsing of such files can exhaust the host process's memory. The flaw is reachable by any Node.js application, service, or bundled front end that hands attacker-supplied .ape/MP3-with-APEv2 media to the parser; it is fixed in 11.16.0. The demonstrated impact is availability loss only - the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.2) with no confidentiality or integrity effect, and no public exploit code or confirmed active exploitation was identified at time of analysis.