Is CVE-2026-107388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107388 being exploited in the wild.

How severe is CVE-2026-107388?

Medium severity, with a CVSS score of 6.2, published 8 October 2026.

Which products and versions are affected?

Music-Metadata all versions prior to fix; music-metadata (npm) <= 11.12.3, SEMVER:introduced=0,fixed=11.16.0.

How is CVE-2026-107388 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107388?

Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107388: music-metadata ID3v2 tag buffer allocation DoS

Q: Is there a fix for CVE-2026-107388?

Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Validate the ID3v2 tag size against the remaining file size and enforce a reasonable maximum allocation limit (e.g., 50 MB) before allocating buffers. Handle stream read failures explicitly rather than silently catching errors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-107388 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library used by music streaming, podcast, and media services to extract metadata from audio files. A flaw in its ID3v2 tag parser trusts an unvalidated size field and allocates massive memory buffers (up to 268 MB) before reading, allowing a 10-byte malicious file to exhaust server memory and cause service outages.

Technologies: Borewit Music-Metadata, Music-Metadata, music-metadata (npm). Vendors: Borewit, Music-Metadata, npm.

Quick answers

Is CVE-2026-107388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107388 being exploited in the wild.
How severe is CVE-2026-107388?: Medium severity, with a CVSS score of 6.2, published 8 October 2026.
Which products and versions are affected?: Music-Metadata all versions prior to fix; music-metadata (npm) <= 11.12.3, SEMVER:introduced=0,fixed=11.16.0.
Is there a fix for CVE-2026-107388?: Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Validate the ID3v2 tag size against the remaining file size and enforce a reasonable maximum allocation limit (e.g., 50 MB) before allocating buffers. Handle stream read failures explicitly rather than silently catching errors.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107388 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107388?: Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

music-metadata (npm): upgrade to 11.16.0 or later
```
npm install music-metadata@11.16.0
```

Validate the ID3v2 tag size against the remaining file size and enforce a reasonable maximum allocation limit (e.g., 50 MB) before allocating buffers. Handle stream read failures explicitly rather than silently catching errors.</anigation> </invoke>

Technical details

The ID3v2 parser reads a syncsafe integer tag size field without validating it against the actual file size or a reasonable maximum, then pre-allocates a buffer of that full size. When the stream read fails due to insufficient data, the error is silently caught and the allocation persists, enabling memory exhaustion DoS via network-supplied files (MP3, FLAC, DSF, Musepack formats).

Affected products

music-metadata music-metadata all versions prior to fix

Identifiers

CVE-2026-107388
GHSA-jjpr-9cvf-cq55

Timeline

2026-10-08: disclosed: Vulnerability disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.