CVE-2026-107391: music-metadata MP4 stsd infinite loop denial of service

CVE-2026-107391 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library that extracts metadata from audio and video files. A malformed MP4 file with a zero-length sample entry can cause the parser to spin in an infinite loop, freezing the entire Node.js process and blocking all other requests. An attacker can exploit this with a tiny 48-byte file, causing a complete denial of service to any application that parses untrusted media files.

Technologies: Borewit Music-Metadata, Music-Metadata, music-metadata (npm). Vendors: Borewit, Music-Metadata, npm.

Quick answers

Is CVE-2026-107391 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107391 being exploited in the wild.
How severe is CVE-2026-107391?
Medium severity, with a CVSS score of 6.2, published 8 October 2026.
Which products and versions are affected?
Music-Metadata master branch (unreleased; not present in 11.14.0 or earlier); music-metadata (npm) < 11.16.0, SEMVER:introduced=0,fixed=11.16.0.
Is there a fix for CVE-2026-107391?
Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Do not merge or deploy the affected code from the master branch until a fix is released. If already deployed, restrict parsing of untrusted MP4 files or implement a timeout around parseBuffer/parseFile/parseStream/parseBlob/parseWebStream calls.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107391 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-107391?
Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • music-metadata (npm): upgrade to 11.16.0 or later
    npm install music-metadata@11.16.0

Do not merge or deploy the affected code from the master branch until a fix is released. If already deployed, restrict parsing of untrusted MP4 files or implement a timeout around parseBuffer/parseFile/parseStream/parseBlob/parseWebStream calls.</anigation> </invoke>

Technical details

The StsdAtom.get() function in lib/mp4/AtomToken.ts contains a synchronous loop that parses MP4 sample description entries. When an entry's size field is 0, the cursor advance becomes `size - 4 = -4`, which when added to the prior `+4` offset increment results in zero net progress. With a high entry_count value, the loop never terminates and blocks the event loop entirely. The vulnerability was introduced by a prior fix (commit d2a7d6f) that changed the cursor advancement from `off += size` to `off += size - 4` without guarding against size values less than 4.

Affected products

  • music-metadata music-metadata master branch (unreleased; not present in 11.14.0 or earlier)

Identifiers

  • CVE-2026-107391
  • GHSA-f94x-6692-553q

Timeline

  • 2026-10-08: disclosed: GHSA advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.