CVE-2026-25579

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

• CWE-400
• CWE-770
• CWE-789

• https://github.com/navidrome/navidrome/releases/tag/v0.60.0Product, Release Notes
• https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3Exploit, Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25573A vulnerability has been identified in SICAM SIAPP SDK (All …7.8
• CVE-2026-25574Payload is a free and open source headless content managemen…5.4
• CVE-2026-25575NavigaTUM is a website and API to search for rooms, building…7.5
• CVE-2026-25576ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-25577Emmett is a framework designed to simplify your development …7.5
• CVE-2026-25578Navidrome is an open source web-based music collection serve…6.1
• CVE-2026-2558A flaw has been found in GeekAI up to 4.2.4. The affected el…6.3
• CVE-2026-25580Pydantic AI is a Python agent framework for building applica…8.6
• CVE-2026-25581SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. P…5.4
• CVE-2026-25582iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25583iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25584iccDEV provides a set of libraries and tools that allow for …7.8