CVE-2026-107387 in Music-Metadata
Summary
by MITRE • 10/08/2026
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in the music-metadata library prior to version 11.16.0 represents a critical resource management flaw within its APEv2 metadata parser, specifically affecting how binary data items are handled during file parsing operations. The core technical deficiency lies in the sequence of memory allocation relative to input validation. When processing an APE tag item that is designated as binary, such as embedded cover art or other large media blobs, the library allocates a Uint8Array based on the size field declared within the attacker-controlled metadata header before verifying whether this allocated size actually fits within the remaining bounds of the tag structure or the file data itself. This out-of-order validation allows an adversary to craft a malicious APE audio file with an artificially inflated item-size value that far exceeds the actual available space in the container, thereby triggering a disproportionate memory allocation request from the underlying Node.js runtime environment.
This architectural flaw directly leads to severe availability impacts through resource exhaustion attacks. Because the library attempts to allocate memory for potentially massive binary items without first confirming their validity against the file's structural limits, processing such crafted files can cause rapid and significant consumption of process heap space. The impact is exacerbated when multiple malicious files are parsed concurrently or in a loop, as each instance triggers independent large allocations that compound quickly. This behavior effectively creates a denial-of-service condition where the application hosting the music-metadata library may become unresponsive or crash due to out-of-memory errors, disrupting service availability for legitimate users and potentially causing cascading failures in dependent systems relying on stable media processing services.
From an industry standards perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to properly limit the amount of resources consumed by a specific operation based on untrusted input. Furthermore, it relates closely to CWE-789, Memory Allocation with Excessive Size Value, where the system allocates memory for an excessively large size value derived from user-controlled data without adequate bounds checking prior to allocation. In terms of adversarial tactics, this flaw can be leveraged within the ATT&CK framework under T1496 Resource Hijacking, specifically in the context of Denial of Service via resource exhaustion, where attackers aim to degrade or disrupt service availability rather than compromising confidentiality or integrity directly.
The resolution for this issue was implemented in version 11.16.0 by correcting the validation logic within the APEv2 parser. The fix ensures that the library strictly validates whether a declared item size is consistent with the remaining data available in the tag and file before proceeding to allocate memory buffers. This change enforces proper input sanitization practices, ensuring that resource allocation decisions are predicated on verified structural integrity rather than trusting unvalidated metadata headers. To mitigate this risk, organizations utilizing music-metadata must upgrade immediately to version 11.16.0 or later. Additionally, defensive coding strategies such as implementing rate limiting for file uploads and monitoring memory usage patterns can provide supplementary protection against potential abuse vectors in production environments until the patch is fully deployed across all affected systems.