# CVE-2026-107389: music-metadata EBML parser memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-107389-music-metadata-ebml-parser-trusts-element-lengths-allowing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107389 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library that parses audio and video file metadata. A flaw in its Matroska/WebM EBML parser allows tiny crafted media files to trigger massive memory allocations or crash the application entirely. Attackers can deny service to applications that process untrusted media files by providing specially crafted audio or video files.

Technologies: [Borewit Music-Metadata](https://junglewise.ai/threats/technologies/borewit-music-metadata), [music-metadata (npm)](https://junglewise.ai/threats/technologies/music-metadata). Vendors: [Borewit](https://junglewise.ai/threats/vendors/borewit), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107389 being exploited in the wild.

**How severe is CVE-2026-107389?** Medium severity, with a CVSS score of 6.2, published 8 October 2026.

**Which products and versions are affected?** Borewit Music-Metadata before 11.15.1; music-metadata (npm) < 11.16.0, SEMVER:introduced=0,fixed=11.16.0.

**Is there a fix for CVE-2026-107389?** Yes. music-metadata (npm): upgrade to 11.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107389 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107389?** Check whether you run Borewit Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- music-metadata (npm): upgrade to 11.16.0 or later

  ```sh
  npm install music-metadata@11.16.0
  ```


## Technical details

The EBML parser in music-metadata decodes variable-length integer element sizes without validating that declared lengths fit within their enclosing container or available input, allowing attacker-controlled lengths to reach string and binary allocations. Leaf readers then directly allocate based on these untrusted lengths. Depending on Node.js version and API entry point, exploitation can cause out-of-memory conditions, catchable allocation failures, or uncatchable V8 fatal aborts (exit code 133).

## Affected products

- Borewit music-metadata before 11.15.1

## Identifiers

- CVE-2026-107389
- GHSA-5gfj-9q3v-qfp3

## Timeline

- 2026-10-08: disclosed

## Related threats

- [music-metadata uncatchable process crash parsing DSF files](https://junglewise.ai/threats/cve-2026-107392-music-metadata-uncatchable-process-crash-parsing-a-crafted-dsf)
- [music-metadata MP4 stsd infinite loop denial of service](https://junglewise.ai/threats/cve-2026-107391-music-metadata-mp4-stsd-sample-entry-size-0-causes-a-synchronous)
- [music-metadata MP4 parser integer overflow in atom size parsing](https://junglewise.ai/threats/cve-2026-107390-music-metadata-is-a-metadata-parser-for-audio-and-video-media)
- [music-metadata ID3v2 tag buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107388-music-metadata-id3v2-tag-size-not-validated-before-allocation)
- [music-metadata uncontrolled memory allocation in APEv2 parser](https://junglewise.ai/threats/cve-2026-107387-music-metadata-uncontrolled-memory-allocation-in-apev2-parser)