CVE-2026-107387: Uncontrolled Memory Allocation (OOM) in music-metadata APEv2 Parser

Vulnerability ID: CVE-2026-107387
CVSS Score: 6.2
Published: 2026-10-08

CVE-2026-107387 is a high-impact uncontrolled memory allocation vulnerability in music-metadata, a widely used Node.js metadata parser. The flaw occurs in the APEv2 tag parser, where the library reads an attacker-controlled 32-bit integer indicating the tag size and immediately requests a corresponding heap buffer reservation. Because this allocation occurs before validating if the input stream actually contains those bytes, an attacker can supply a minuscule audio file to trigger large, disproportionate allocations, resulting in heap exhaustion and an uncatchable process-wide Out of Memory (OOM) crash.

TL;DR

A vulnerability in music-metadata (< 11.16.0) allows remote attackers to cause a Denial of Service (DoS) via an Out Of Memory (OOM) crash by uploading a tiny (134-byte) audio file containing a forged APEv2 tag size value.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-789
  • Attack Vector: Local
  • CVSS Score: 6.2
  • EPSS Score: Not Available
  • Impact: Denial of Service (DoS)
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Applications utilizing Borewit music-metadata library versions prior to 11.16.0
  • Node.js media ingestion pipelines parsing APEv2/Monkey's Audio files
  • music-metadata: < 11.16.0 (Fixed in: 11.16.0)

Code Analysis

Commit: b3bf52c

Fix: Avoid Out Of Memory crash in APEv2 parser due to unvalidated size fields

Exploit Details

  • GitHub Advisory Database: A fully functional proof-of-concept payload demonstrating process crash using a small (134 bytes) crafted APE file.

Mitigation Strategies

  • Upgrade music-metadata dependency to version 11.16.0 or higher.
  • Implement application-level file size filters to drop abnormally small media files prior to metadata analysis.
  • Configure Node.js execution flags (e.g., --max-old-space-size) to enforce memory caps on worker processes.
  • Isolate the media parsing logic inside isolated containers or sandboxed worker subprocesses to contain crash impacts.

Remediation Steps:

  1. Execute 'npm ls music-metadata' to detect vulnerable versions in the project tree.
  2. Edit the package.json file to specify "music-metadata": "^11.16.0".
  3. Execute 'npm update music-metadata' to download and apply the patch.
  4. Run automated test suites to verify that APEv2 metadata operations continue to execute successfully under the new constraints.

References

Read the full report for CVE-2026-107387 on our website for more details including interactive diagrams and full exploit analysis.