Memory Growth Vulnerability in Navidrome Music Collection Server

CVE-2026-25579

What is CVE-2026-25579?

Navidrome, an open-source web-based music collection server, is vulnerable to a memory overflow due to improper handling of size parameters in its image processing endpoints. Authenticated users can exploit this flaw by sending excessively large size parameters to either the /rest/getCoverArt endpoint or shared-image URLs. Such requests can cause uncontrolled memory growth, leading to service outages as the Linux OOM killer terminates the process. Furthermore, in cases where the server manages to allocate the resources, it may write these oversized images into its cache directory, which can rapidly deplete server disk space. This critical issue has been addressed in version 0.60.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References