Is CVE-2026-32256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32256 being exploited in the wild.

How severe is CVE-2026-32256?

Low severity, with a CVSS score of 3.1, published 17 March 2026.

Which products and versions are affected?

music-metadata (npm) SEMVER:introduced=0,fixed=11.12.3.

Is there a fix for CVE-2026-32256?

Yes. music-metadata (npm): upgrade to 11.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32256 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-32256?

Check whether you run music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32256: music-metadata infinite loop in ASF parser

CVE-2026-32256 · Severity: low · CVSS 3.1 · Published 2026-03-17

music-metadata is a widely-used Node.js library (2.2M weekly downloads) that parses audio file metadata from various formats including ASF/WMA. A maliciously crafted ASF file can trigger an infinite loop in the parser, causing any application using the parseFile() or parseBuffer() methods to hang indefinitely. This can lead to denial of service where legitimate audio processing tasks freeze permanently.

Technologies: music-metadata (npm). Vendors: npm.

Quick answers

Is CVE-2026-32256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32256 being exploited in the wild.
How severe is CVE-2026-32256?: Low severity, with a CVSS score of 3.1, published 17 March 2026.
Which products and versions are affected?: music-metadata (npm) SEMVER:introduced=0,fixed=11.12.3.
Is there a fix for CVE-2026-32256?: Yes. music-metadata (npm): upgrade to 11.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32256 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-32256?: Check whether you run music-metadata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

music-metadata (npm): upgrade to 11.12.3 or later
```
npm install music-metadata@11.12.3
```

Technical details

The vulnerability is an infinite loop in the ASF parser's parseExtensionObject() function (lib/asf/AsfParser.ts:112-158). When a sub-object within the ASF Header Extension Object has objectSize = 0, the parser calculates remaining = 0 - 24 = -24, then calls tokenizer.ignore(-24) to move backward, but the loop counter (extensionSize) is not decremented, so the while(extensionSize > 0) condition never exits. The root cause is that strtok3's AbstractTokenizer.ignore() accepts negative values without validation. The parseFile() and parseBuffer() methods are affected and will hang when processing a maliciously crafted 100-byte ASF file, while parseStream() is unaffected because it uses a different ignore() implementation that throws a RangeError. The vulnerability has been fixed in version 11.12.3.

Affected products

Borewit music-metadata <11.12.3

Identifiers

CVE-2026-32256
GHSA-v6c2-xwv6-8xf7

Timeline

2026-03-17: disclosed: Vulnerability published on GitHub
2026-03-17: patched: Fixed in version 11.12.3

References

https://github.com/Borewit/music-metadata/security/advisories/GHSA-v6c2-xwv6-8xf7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.