Denial of Service Vulnerability in Music Metadata Parser by Borewit

CVE-2026-107389

What is CVE-2026-107389?

The music-metadata parser, utilized for audio and video files, is susceptible to a denial of service due to improper validation of leaf-length in the Matroska and WebM EBML parser. This flaw allows an attacker to exploit abnormal input lengths for VINT elements, resulting in excessive memory allocation or, under certain conditions, causing Node.js to terminate unexpectedly with a fatal abort error. The issue has been resolved in version 11.16.0, emphasizing the need for users to update their installations to mitigate the risks associated with crafted WebM, MKV, or MKA files.

References