CVE-2026-107392: music-metadata Unhandled Rejection Leads to Process Crash
Summary
CVE-2026-107392: music-metadata: uncatchable process crash parsing a crafted .dsf (residual of GHSA-v6c2-xwv6-8xf7). Affects music-metadata versions < 11.15.0. Fixed in 11.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
music-metadata is a popular npm package used for parsing audio metadata from various file formats. It supports a wide range of audio formats and is widely utilized in applications that require audio file analysis. However, it has a vulnerability that can lead to a process crash when parsing specially crafted .dsf files, making it susceptible to denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from an unhandled promise rejection in the DsfParser class of the music-metadata package. Specifically, the method DsfParser.parseChunks fails to await a call to ignore a chunk's payload, which can lead to a RangeError when the size of the chunk is less than the expected length. This unhandled rejection can crash the Node.js process, bypassing any error handling implemented by the caller. The issue is a residual effect of a previous vulnerability fix and affects versions up to 11.14.0.
How To Fix
Latest published version: 12.2.3 as of 22 Oct 2026
npm install music-metadata@12.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.15.0
This is the first release that contains the fix.
npm install music-metadata@11.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a try/catch block around the parseBuffer method to handle potential errors. However, this will not prevent the crash if the vulnerability is triggered. It is recommended to update the package as soon as possible.
Conclusion
The music-metadata package has a vulnerability that can lead to process crashes when parsing certain audio files. It is crucial to update to the patched version to mitigate the risk of denial-of-service attacks. Implementing proper error handling can provide temporary relief, but updating the package is the best long-term solution.
See every vulnerability recorded for music-metadata →
FAQ
The vulnerability can lead to a denial-of-service (DoS) attack, where a single crafted .dsf file can crash the Node.js process of any application using music-metadata.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Versions of music-metadata up to and including 11.14.0 are affected by this vulnerability. The issue is resolved in version 11.15.0.
If you cannot update the package immediately, implement error handling around the parsing logic to mitigate the risk of crashes, but be aware that this is only a temporary solution.
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for music-metadata.
