# CVE-2026-107388: music-metadata ID3v2 tag buffer allocation DoS

Source: https://junglewise.ai/threats/cve-2026-107388-music-metadata-id3v2-tag-size-not-validated-before-allocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107388 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library used by music streaming, podcast, and media services to extract metadata from audio files. A flaw in its ID3v2 tag parser trusts an unvalidated size field and allocates massive memory buffers (up to 268 MB) before reading, allowing a 10-byte malicious file to exhaust server memory and cause service outages.

Technologies: [Borewit Music-Metadata](https://junglewise.ai/threats/technologies/borewit-music-metadata), [Music-Metadata](https://junglewise.ai/threats/technologies/music-metadata-music-metadata), [music-metadata (npm)](https://junglewise.ai/threats/technologies/music-metadata). Vendors: [Borewit](https://junglewise.ai/threats/vendors/borewit), [Music-Metadata](https://junglewise.ai/threats/vendors/music-metadata), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107388 being exploited in the wild.

**How severe is CVE-2026-107388?** Medium severity, with a CVSS score of 6.2, published 8 October 2026.

**Which products and versions are affected?** Music-Metadata all versions prior to fix; music-metadata (npm) <= 11.12.3, SEMVER:introduced=0,fixed=11.16.0.

**Is there a fix for CVE-2026-107388?** Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Validate the ID3v2 tag size against the remaining file size and enforce a reasonable maximum allocation limit (e.g., 50 MB) before allocating buffers. Handle stream read failures explicitly rather than silently catching errors.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107388 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107388?** Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- music-metadata (npm): upgrade to 11.16.0 or later

  ```sh
  npm install music-metadata@11.16.0
  ```


Validate the ID3v2 tag size against the remaining file size and enforce a reasonable maximum allocation limit (e.g., 50 MB) before allocating buffers. Handle stream read failures explicitly rather than silently catching errors.</anigation>
</invoke>

## Technical details

The ID3v2 parser reads a syncsafe integer tag size field without validating it against the actual file size or a reasonable maximum, then pre-allocates a buffer of that full size. When the stream read fails due to insufficient data, the error is silently caught and the allocation persists, enabling memory exhaustion DoS via network-supplied files (MP3, FLAC, DSF, Musepack formats).

## Affected products

- music-metadata music-metadata all versions prior to fix

## Identifiers

- CVE-2026-107388
- GHSA-jjpr-9cvf-cq55

## Timeline

- 2026-10-08: disclosed: Vulnerability disclosed

## Related threats

- [music-metadata uncatchable process crash parsing DSF files](https://junglewise.ai/threats/cve-2026-107392-music-metadata-uncatchable-process-crash-parsing-a-crafted-dsf)
- [music-metadata MP4 stsd infinite loop denial of service](https://junglewise.ai/threats/cve-2026-107391-music-metadata-mp4-stsd-sample-entry-size-0-causes-a-synchronous)
- [music-metadata MP4 parser integer overflow in atom size parsing](https://junglewise.ai/threats/cve-2026-107390-music-metadata-is-a-metadata-parser-for-audio-and-video-media)
- [music-metadata EBML parser memory exhaustion](https://junglewise.ai/threats/cve-2026-107389-music-metadata-ebml-parser-trusts-element-lengths-allowing)
- [music-metadata uncontrolled memory allocation in APEv2 parser](https://junglewise.ai/threats/cve-2026-107387-music-metadata-uncontrolled-memory-allocation-in-apev2-parser)