CVE-2026-107389 Borewit CVE debrief

Who should care

Defenders responsible for systems that parse untrusted Matroska/WebM media should assess exposure and prioritize updates to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that systems under their control are not exposed to this vulnerability.

Why it matters

This vulnerability in the music-metadata library can lead to denial of service via memory exhaustion or process abort when parsing untrusted Matroska/WebM media. Defenders should prioritize updates to version 11.16.0 or later and assess systems for exposure.

• Denial of service via memory exhaustion
• Denial of service via process abort
• Potential for large memory allocations
• Need for verification of affected versions and remediation

Technical summary

The music-metadata library's EBML parser does not validate element lengths before using them for allocations, leading to potential denial of service via memory exhaustion or process abort when parsing untrusted Matroska/WebM media. The vulnerability was demonstrated with specific inputs causing large allocations and a V8 fatal abort. The issue was reproduced on music-metadata 11.15.0 with Node.js 26.7.0. Defenders should prioritize updating to version 11.16.0 or later of the music-metadata library to mitigate this vulnerability.

Defensive priority

Defenders should prioritize updating to version 11.16.0 or later of the music-metadata library to mitigate this vulnerability. Systems that parse untrusted Matroska/WebM media are at risk and should be assessed for exposure.

Recommended defensive actions

• Update to music-metadata version 11.16.0 or later
• Assess systems that parse untrusted Matroska/WebM media for exposure
• Monitor for unusual memory consumption or process aborts in affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was demonstrated with specific inputs causing large allocations and a V8 fatal abort. The issue was reproduced on music-metadata 11.15.0 with Node.js 26.7.0. The demonstrated outcomes include a 34-byte input causing an approximately 128 MiB allocation before end-of-input, a 70-byte input causing a 500 MiB allocation through a binary EBML leaf, with concurrent parses multiplying memory consumption, and a 48-byte file causing an uncatchable V8 fatal abort through `parseFile` when a leaf declares a length of 32 GiB.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.