CVE-2026-107391 Borewit CVE debrief

Who should care

Defenders of services that parse user-uploaded audio/video metadata using music-metadata should assess exposure and prioritize patching or mitigation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-107391, a DoS vulnerability in music-metadata, especially in services that parse user-uploaded audio/video metadata, as it can cause a synchronous infinite loop and block the Node.js event loop.

• Denial-of-service (DoS) attack
• Event loop blocking in Node.js
• Potential for service disruption

Technical summary

The StsdAtom.get() function in lib/mp4/AtomToken.ts is vulnerable to a DoS attack when parsing MP4 files with a sample description box entry size of 0. This issue is present on the master branch but not in the latest npm release (11.14.0) or earlier versions. The vulnerability causes a synchronous infinite loop, blocking the Node.js event loop entirely for the whole process. A 48-byte file is enough to hang any service that parses user-uploaded audio/video metadata through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in services that parse user-uploaded audio/video metadata.

Recommended defensive actions

• Patch music-metadata to version 11.16.0 or later
• Mitigate by limiting user-uploaded audio/video metadata parsing
• Monitor for suspicious MP4 file uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the StsdAtom.get() function in lib/mp4/AtomToken.ts, which parses an MP4 stsd (sample description) box's entry table. When the entry size is 0, the function spins forever, blocking the Node.js event loop entirely for the whole process. A 48-byte file is enough to hang any service that parses user-uploaded audio/video metadata through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream. This issue is currently unreleased — present on the master branch only, not in the latest npm release (11.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.