music-metadata
npm6 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting music-metadatapage 1 of 1
- CVE-2026-107387MEDIUMCVSS 5.5EG 6.2fixed in 11.16.02026-10-08
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in t…
- CVE-2026-107388MEDIUMCVSS 5.5EG 6.2fixed in 11.16.02026-10-08
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A…
- CVE-2026-107389MEDIUMCVSS 5.5EG 6.2fixed in 11.16.02026-10-08
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confir…
- CVE-2026-107391HIGHCVSS 7.5EG 7.5fixed in 11.16.02026-10-08
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sampl…
- CVE-2026-107392HIGHCVSS 7.5EG 7.5fixed in 11.15.02026-10-08
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size …
- CVE-2026-32256HIGHCVSS 7.5EG 7.5fixed in 11.12.32026-03-18
music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the AS…
Check whether music-metadata is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for music-metadata CVEs against the assets you own.
Book a Demo →