Is CVE-2026-107389 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107389 being exploited in the wild.

How severe is CVE-2026-107389?

Medium severity, with a CVSS score of 6.2, published 8 October 2026.

Which products and versions are affected?

Borewit Music-Metadata before 11.15.1; music-metadata (npm) < 11.16.0, SEMVER:introduced=0,fixed=11.16.0.

Is there a fix for CVE-2026-107389?

Yes. music-metadata (npm): upgrade to 11.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107389 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107389?

Check whether you run Borewit Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107389: music-metadata EBML parser memory exhaustion

Q: Is there a fix for CVE-2026-107389?

Yes. music-metadata (npm): upgrade to 11.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107389 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107389?

Check whether you run Borewit Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107389 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library that parses audio and video file metadata. A flaw in its Matroska/WebM EBML parser allows tiny crafted media files to trigger massive memory allocations or crash the application entirely. Attackers can deny service to applications that process untrusted media files by providing specially crafted audio or video files.

Technologies: Borewit Music-Metadata, music-metadata (npm). Vendors: Borewit, npm.

Quick answers

Is CVE-2026-107389 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107389 being exploited in the wild.
How severe is CVE-2026-107389?: Medium severity, with a CVSS score of 6.2, published 8 October 2026.
Which products and versions are affected?: Borewit Music-Metadata before 11.15.1; music-metadata (npm) < 11.16.0, SEMVER:introduced=0,fixed=11.16.0.
Is there a fix for CVE-2026-107389?: Yes. music-metadata (npm): upgrade to 11.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107389 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107389?: Check whether you run Borewit Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

music-metadata (npm): upgrade to 11.16.0 or later
```
npm install music-metadata@11.16.0
```

Technical details

The EBML parser in music-metadata decodes variable-length integer element sizes without validating that declared lengths fit within their enclosing container or available input, allowing attacker-controlled lengths to reach string and binary allocations. Leaf readers then directly allocate based on these untrusted lengths. Depending on Node.js version and API entry point, exploitation can cause out-of-memory conditions, catchable allocation failures, or uncatchable V8 fatal aborts (exit code 133).

Affected products

Borewit music-metadata before 11.15.1

Identifiers

CVE-2026-107389
GHSA-5gfj-9q3v-qfp3

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.