Is CVE-2026-107387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107387 being exploited in the wild.

How severe is CVE-2026-107387?

Medium severity, with a CVSS score of 6.2, published 8 October 2026.

Which products and versions are affected?

Music-Metadata 11.15.0; music-metadata (npm) <= 11.12.3, SEMVER:introduced=0,fixed=11.16.0.

How is CVE-2026-107387 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-107387?

Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107387: music-metadata uncontrolled memory allocation in APEv2 parser

Q: Is there a fix for CVE-2026-107387?

Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Avoid parsing APE files from untrusted sources, or validate and sanitize APE files before processing with music-metadata. Implement resource limits (memory quotas or timeouts) on metadata parsing operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107387 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-107387?

Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107387 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a Node.js library that parses audio file metadata from formats like APE, ID3, and MP4. The APEv2 parser allocates memory based on tag size values read from untrusted files without first validating that the file contains enough data. An attacker can craft a tiny malicious APE file that causes the parser to allocate gigabytes of memory, exhausting available RAM and crashing applications that process untrusted audio files.

Technologies: Borewit Music-Metadata, Music-Metadata, music-metadata (npm). Vendors: Borewit, Music-Metadata, npm.

Quick answers

Is CVE-2026-107387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107387 being exploited in the wild.
How severe is CVE-2026-107387?: Medium severity, with a CVSS score of 6.2, published 8 October 2026.
Which products and versions are affected?: Music-Metadata 11.15.0; music-metadata (npm) <= 11.12.3, SEMVER:introduced=0,fixed=11.16.0.
Is there a fix for CVE-2026-107387?: Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Avoid parsing APE files from untrusted sources, or validate and sanitize APE files before processing with music-metadata. Implement resource limits (memory quotas or timeouts) on metadata parsing operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107387 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-107387?: Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

music-metadata (npm): upgrade to 11.16.0 or later
```
npm install music-metadata@11.16.0
```

Avoid parsing APE files from untrusted sources, or validate and sanitize APE files before processing with music-metadata. Implement resource limits (memory quotas or timeouts) on metadata parsing operations.

Technical details

The vulnerability is an uncontrolled memory allocation flaw in the APEv2 tag parser (lib/apev2/APEv2Parser.ts). The parser reads a 32-bit size value from a tag item header and immediately allocates a buffer of that size for binary items (e.g., cover art) without validating whether the remaining file data actually contains that many bytes. A 134-byte crafted APE file can trigger a 128 MiB allocation before an end-of-stream error occurs. Attack vector is network or local (parsing untrusted files), no authentication required.

Affected products

music-metadata music-metadata 11.15.0

Identifiers

CVE-2026-107387
GHSA-53v6-4h7p-p4gj

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.