CVE-2026-107391: Synchronous Infinite Loop and Memory Exhaustion in music-metadata MP4 Parser

Vulnerability ID: CVE-2026-107391
CVSS Score: 6.2
Published: 2026-10-08

An input validation vulnerability exists in music-metadata versions prior to 11.16.0, where parsing a crafted MP4 file containing a sample-description (stsd) box with a zero-value size entry causes a synchronous infinite loop and memory exhaustion, resulting in complete Denial of Service.

TL;DR

A regression in the MP4 stsd parser of music-metadata allows unauthenticated local or remote attackers to trigger a synchronous infinite loop and memory exhaustion via a crafted media file, blocking the Node.js event loop.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-835 / CWE-400
  • Attack Vector: Local (AV:L)
  • CVSS v3.1 Score: 6.2 (Medium)
  • Exploit Status: PoC Validated
  • Impact: Denial of Service (DoS) and Memory Exhaustion (OOM)
  • KEV Status: Not Listed

Affected Systems

  • Applications utilizing music-metadata versions < 11.16.0
  • Node.js server-side media upload processors
  • Client-side browser applications parsing user-supplied MP4 files
  • music-metadata: < 11.16.0 (Fixed in: 11.16.0)

Exploit Details

Mitigation Strategies

  • Upgrade music-metadata dependency to version 11.16.0 or higher.
  • Isolate untrusted media parsing tasks inside Node.js Worker Threads.
  • Implement OS or process-level limits (PM2/systemd) to restart stalled processes.

Remediation Steps:

  1. Identify all projects using music-metadata by running dependency checks (e.g., npm list music-metadata).
  2. Update package.json to reference version ^11.16.0.
  3. Run npm update music-metadata or yarn upgrade music-metadata.
  4. Deploy code to a staging environment and verify MP4 media file uploads function normally.

References

Read the full report for CVE-2026-107391 on our website for more details including interactive diagrams and full exploit analysis.