music-metadata vulnerabilities
CVEs whose affected-version data names the music-metadata package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-107390Medium· 6.2PoCmusic-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for…
CVE-2026-107392Medium· 6.2PoCmusic-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk siz…
CVE-2026-107391Medium· 6.2music-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sam…
CVE-2026-107389Medium· 6.2PoCmusic-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before conf…
CVE-2026-107388Medium· 6.2PoCmusic-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes.…
CVE-2026-107387Medium· 6.2PoCmusic-metadata is a metadata parser for audio and video media files
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in…