music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS (CVE-2026-107388)

What happened

The ID3v2 parser in music-metadata trusts the syncsafe tag-size field and allocates memory for the full tag body before checking whether the input actually contains the declared number of bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the internal EndOfStreamError is caught, and the caller receives a normal metadata object despite the truncated input. This behavior can lead to memory exhaustion and an availability impact. (Sources: 4114, 9015, 31888)

Technical cause

The parser uses the syncsafe tag-size value from the ID3v2 header to allocate the complete tag body before validating that the input contains the declared bytes. This unchecked allocation is the root cause, and the issue is categorized under CWE-789 (uncontrolled memory allocation). (Sources: 4114, 9015, 31888)

Why it matters

The flaw can cause large memory allocations and lead to denial of service (availability impact) when processing crafted or truncated media files. The computed CVSS v3.1 base score is 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Patchwire assigns a remediation priority score of 3.6 for this issue. There are no known public exploits or reports of active exploitation in the provided sources. (Sources: 4114, 9015, 31888)

Who is affected

Projects that use the music-metadata npm package are affected. The advisory indicates the issue exists in releases introduced at version 0 and is fixed in 11.16.0. (Sources: 4114, 9015, 31888)

Discovery and timeline

The vulnerability is cataloged in public databases with publication entries on 2026-10-08 (sources list published timestamps around that date). The OSV entry and CVE/NVD records document the issue. (Sources: 4114, 9015, 31888)

Affected versions

The advisory reports the affected range as introduced at 0 and fixed in 11.16.0. Users running any release prior to 11.16.0 are in the affected range described by the sources. (Sources: 4114, 9015, 31888)

Fixes and mitigation

A fix is available in the vendor update 11.16.0. The sources list 11.16.0 as the fixed version. (Sources: 4114, 9015, 31888)

Recommended action

Update instances of music-metadata to 11.16.0. The published advisories identify 11.16.0 as the release that contains the fix. (Sources: 4114, 9015, 31888)