CVE-2026-32256: music-metadata Infinite Loop Vulnerability in ASF Parser
Summary
CVE-2026-32256: music-metadata has an infinite loop vulnerability in ASF parser. Affects music-metadata versions < 11.12.3. Fixed in 11.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
music-metadata is an open-source library used for parsing metadata from various audio file formats. It supports a wide range of formats and is widely utilized in applications requiring audio file analysis. The library has gained significant popularity, evidenced by its 2.2 million weekly downloads on npm. However, it is susceptible to a critical vulnerability in its ASF parser, which can lead to application hangs when processing malformed files.
Vulnerability Detail
The vulnerability arises in the ASF parser's method parseExtensionObject(), where it enters an infinite loop if a sub-object within the ASF Header Extension Object has an objectSize of 0. This results in the loop counter never decreasing, causing the application to hang indefinitely while re-reading the same 24-byte header. The issue is similar to a previously identified vulnerability in the file-type library, where negative values are accepted without validation. The impact is severe, as a specially crafted 100-byte ASF file can cause any application using the affected methods to hang permanently.
How To Fix
Latest published version: 12.2.3 as of 22 Oct 2026
npm install music-metadata@12.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.12.3
This is the first release that contains the fix.
npm install music-metadata@11.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can validate the objectSize before processing it in your application. Ensure that objectSize is greater than or equal to the minimum header size before proceeding with any calculations. This can prevent the infinite loop from occurring.
Conclusion
The CVE-2026-32256 vulnerability in the music-metadata library poses a significant risk of application hangs due to an infinite loop in the ASF parser. It is crucial for developers using this library to update to the patched version to mitigate the risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for music-metadata →
FAQ
The vulnerability is an infinite loop in the ASF parser of the music-metadata library, triggered by a sub-object with an objectSize of 0.
If your application uses the affected methods parseFile() or parseBuffer(), it may hang indefinitely when processing a crafted ASF file, leading to a denial of service.
Yes, the fix is available in version 11.12.3 of the music-metadata package. Updating to this version will resolve the issue.
Yes, you can use Vulert to monitor your project for open-source vulnerabilities in real-time by analyzing your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for music-metadata.
