# CVE-2026-107391: music-metadata MP4 stsd infinite loop denial of service

Source: https://junglewise.ai/threats/cve-2026-107391-music-metadata-mp4-stsd-sample-entry-size-0-causes-a-synchronous  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107391 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a JavaScript library that extracts metadata from audio and video files. A malformed MP4 file with a zero-length sample entry can cause the parser to spin in an infinite loop, freezing the entire Node.js process and blocking all other requests. An attacker can exploit this with a tiny 48-byte file, causing a complete denial of service to any application that parses untrusted media files.

Technologies: [Borewit Music-Metadata](https://junglewise.ai/threats/technologies/borewit-music-metadata), [Music-Metadata](https://junglewise.ai/threats/technologies/music-metadata-music-metadata), [music-metadata (npm)](https://junglewise.ai/threats/technologies/music-metadata). Vendors: [Borewit](https://junglewise.ai/threats/vendors/borewit), [Music-Metadata](https://junglewise.ai/threats/vendors/music-metadata), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107391 being exploited in the wild.

**How severe is CVE-2026-107391?** Medium severity, with a CVSS score of 6.2, published 8 October 2026.

**Which products and versions are affected?** Music-Metadata master branch (unreleased; not present in 11.14.0 or earlier); music-metadata (npm) < 11.16.0, SEMVER:introduced=0,fixed=11.16.0.

**Is there a fix for CVE-2026-107391?** Yes. music-metadata (npm): upgrade to 11.16.0 or later. Until then: Do not merge or deploy the affected code from the master branch until a fix is released. If already deployed, restrict parsing of untrusted MP4 files or implement a timeout around parseBuffer/parseFile/parseStream/parseBlob/parseWebStream calls.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107391 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107391?** Check whether you run Borewit Music-Metadata, Music-Metadata or music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- music-metadata (npm): upgrade to 11.16.0 or later

  ```sh
  npm install music-metadata@11.16.0
  ```


Do not merge or deploy the affected code from the master branch until a fix is released. If already deployed, restrict parsing of untrusted MP4 files or implement a timeout around parseBuffer/parseFile/parseStream/parseBlob/parseWebStream calls.</anigation>
</invoke>

## Technical details

The StsdAtom.get() function in lib/mp4/AtomToken.ts contains a synchronous loop that parses MP4 sample description entries. When an entry's size field is 0, the cursor advance becomes `size - 4 = -4`, which when added to the prior `+4` offset increment results in zero net progress. With a high entry_count value, the loop never terminates and blocks the event loop entirely. The vulnerability was introduced by a prior fix (commit d2a7d6f) that changed the cursor advancement from `off += size` to `off += size - 4` without guarding against size values less than 4.

## Affected products

- music-metadata music-metadata master branch (unreleased; not present in 11.14.0 or earlier)

## Identifiers

- CVE-2026-107391
- GHSA-f94x-6692-553q

## Timeline

- 2026-10-08: disclosed: GHSA advisory published

## Related threats

- [music-metadata uncatchable process crash parsing DSF files](https://junglewise.ai/threats/cve-2026-107392-music-metadata-uncatchable-process-crash-parsing-a-crafted-dsf)
- [music-metadata MP4 parser integer overflow in atom size parsing](https://junglewise.ai/threats/cve-2026-107390-music-metadata-is-a-metadata-parser-for-audio-and-video-media)
- [music-metadata EBML parser memory exhaustion](https://junglewise.ai/threats/cve-2026-107389-music-metadata-ebml-parser-trusts-element-lengths-allowing)
- [music-metadata ID3v2 tag buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107388-music-metadata-id3v2-tag-size-not-validated-before-allocation)
- [music-metadata uncontrolled memory allocation in APEv2 parser](https://junglewise.ai/threats/cve-2026-107387-music-metadata-uncontrolled-memory-allocation-in-apev2-parser)