PT-2026-25979 · Unknown · Music-Metadata

Byamb4

·

Published

2026-03-17

·

Updated

2026-03-18

·

CVE-2026-32256

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.12.3
Description music-metadata is a metadata parser for audio and video media files. The ASF parser within music-metadata, specifically the parseExtensionObject() function in lib/asf/AsfParser.ts:112-158, can enter an infinite loop when processing an ASF Header Extension Object containing a sub-object with objectSize equal to 0. This occurs because the ignore() function within the tokenizer accepts negative values without validation, leading to a continuous re-reading of a 24-byte header. The affected methods are parseFile() and parseBuffer(). An estimated 2.2 million weekly npm downloads are potentially impacted. A crafted 100-byte .asf file can cause applications using parseFile() or parseBuffer() to hang indefinitely. The parseStream() function is not affected as it uses a different ignore() implementation that throws a RangeError.
Recommendations Versions prior to 11.12.3 should be updated to version 11.12.3 or later.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-32256
GHSA-V6C2-XWV6-8XF7

Affected Products

Music-Metadata