CVE-2026-107392 in music-metadata
Summary
by MITRE • 10/08/2026
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within the music-metadata library prior to version 11.15.0 represents a significant flaw in how asynchronous operations are managed during the processing of Digital Stream Format, or DSF, audio files. The core issue resides specifically within the DSF parser component, which is responsible for interpreting metadata chunks embedded in these media containers. When the parser encounters an unrecognized chunk type, it attempts to skip over that data by invoking a tokenizer ignore function. This operation returns a promise intended to signal when the skipping process has completed. However, the implementation fails to await this returned promise and does not validate whether the specified chunk size is sufficiently large to accommodate the mandatory twelve-byte header structure inherent to DSF chunks.
This lack of validation allows for the creation of crafted DSF input files where the chunk size field indicates a value smaller than the required header length. When such an invalid size is processed, particularly in conjunction with strtok3 versions 10.3.5 and later, it triggers a RangeError due to negative or invalid buffer slicing parameters. Because the code does not properly handle this asynchronous error state, the resulting exception becomes detached from the main parseBuffer promise chain. Under Node.js default behavior, unhandled rejections are treated as critical errors that terminate the process rather than being caught by standard try-catch blocks surrounding the initial call to parse metadata.
The operational impact of this vulnerability is primarily focused on availability loss for applications relying on music-metadata to ingest DSF files. An attacker can craft a malicious DSF file containing an improperly sized unrecognized chunk header. When a victim application processes this file, the unhandled rejection causes the Node.js process to crash abruptly. This behavior effectively results in a denial of service condition, as the application becomes unavailable until it is restarted or the specific input is filtered out by upstream defenses. The vulnerability requires that the DSF parsing path be executed, meaning other audio formats are not directly affected by this specific flaw.
From a classification perspective, this issue aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to validate input parameters before performing operations on them. It also relates to CWE-268: Inspection Blindness, where the code ignores critical state information regarding chunk validity. In terms of attack vectors and techniques, this vulnerability can be leveraged within the context of ATT&CK technique T1499: Endpoint Denial of Service, specifically through resource exhaustion via crashes or loops induced by malformed input data delivered to a vulnerable service component.
Mitigation for this issue is straightforward as it has been addressed in version 11.15.0 and subsequent releases of the music-metadata library. Users should update their dependencies immediately to ensure that proper promise handling and chunk size validation are implemented within the DSF parser. Additionally, organizations consuming audio metadata from untrusted sources should implement input sanitization or schema validation at the ingestion layer to reject malformed files before they reach the parsing logic. This defense-in-depth approach ensures that even if a new vulnerability is discovered in future versions of the library, the application remains resilient against crashes caused by invalid media file structures.