CVE-2026-107392

music-metadata is a metadata parser for audio and video media files.

Music-Metadata

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under…

8. Okt 2026

Ausgewertete Quellen

• NVD
  CVE-2026-107392
• GitHub
  https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
• GitHub
  https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j