CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.

• CWE-400
• CWE-835

• https://github.com/Borewit/music-metadata/commit/90a7d52c69e921a0b019592d887acd97b1c8b8a5
• https://github.com/Borewit/music-metadata/pull/2734
• https://github.com/Borewit/music-metadata/releases/tag/v11.16.0
• https://github.com/Borewit/music-metadata/security/advisories/GHSA-f94x-6692-553q

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107386amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14…6.3
• CVE-2026-107387music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107388music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107389music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-10739Cato Networks SDP Client for Windows before 6.12.6 allows a …8.5
• CVE-2026-107390music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Pri…6.1
• CVE-2026-107394Indico is an event management system that uses Flask-Multipa…6.8
• CVE-2026-107395Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-107396Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2