{"id":"CVE-2026-107392","revision":null,"records":[{"revision":"ecc5ec43c5024a2a83c56269957e5f01","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107392","aliases":[],"title":"music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.","state":0,"publishedAt":"2026-10-08T19:13:06.392+00:00","modifiedAt":"2026-10-08T19:53:23.64+00:00","affected":[{"ecosystem":"Vendor product","name":"music-metadata","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Borewit\",\n                    \"product\": \"music-metadata\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 11.15.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j","https://github.com/Borewit/music-metadata/pull/2700","https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41","https://github.com/Borewit/music-metadata/releases/tag/v11.15.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107392","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107392","identifiers":["CVE-2026-107392"]},"retained":false,"historicalAffected":[]},{"revision":"016ac3ef60df4be6a75e1da65c5e8e8f","observedAt":"2026-11-09T05:07:55.872+00:00","statement":{"source":"euvd","id":"EUVD-2026-95248","aliases":["CVE-2026-107392","GHSA-8j4c-6x6g-rq3j"],"title":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size s…","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":null}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j","https://github.com/Borewit/music-metadata/pull/2700","https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41","https://github.com/Borewit/music-metadata/releases/tag/v11.15.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95248","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2026, 7:13:06 PM","dateUpdated":"Oct 8, 2026, 7:53:23 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95248","identifiers":["EUVD-2026-95248","CVE-2026-107392","GHSA-8j4c-6x6g-rq3j"]},"retained":false,"historicalAffected":[]},{"revision":"db950910b64749da9eaeae132d01f204","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-107392","aliases":[],"title":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size s…","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.","state":0,"publishedAt":"2026-10-08T20:17:33.707+00:00","modifiedAt":"2026-10-13T19:35:27.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41","https://github.com/Borewit/music-metadata/pull/2700","https://github.com/Borewit/music-metadata/releases/tag/v11.15.0","https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107392","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-248","CWE-400"],"productCriteria":["cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-10-08T20:17:33.707","lastModified":"2026-10-13T19:35:27.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107392","identifiers":["CVE-2026-107392"]},"retained":false,"historicalAffected":[]},{"revision":"0eabea97fd254ea2bd151861e56d83b1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8j4c-6x6g-rq3j","aliases":["CVE-2026-107392"],"title":"music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)","description":"## Summary\n`DsfParser.parseChunks` skips an unrecognised chunk's payload with an **un-awaited** call:\n```js\nthis.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len);   // lib/dsf/DsfParser.js:51 — no await\n```\n`ChunkHeader.len` is 12. A crafted `.dsf` chunk with `id != 'fmt '` and `size` in `0..11` makes the\nargument negative; strtok3 (≥ 10.3.5) throws `RangeError` on a negative `ignore`. Because the call\nis fire-and-forget, the rejection is **detached from the `parseBuffer()` promise chain** → unhandled\nrejection → Node's default (≥ 15) **crashes the process** — **after** `parseBuffer()` already\nresolved, so a caller's `try/catch` catches nothing and is still taken down.\n\nResidual of GHSA-v6c2-xwv6-8xf7: the ASF site was fixed in 11.12.3 (size validation) and strtok3\nnow throws on negative `ignore`; the DSF site was never validated, and its missing `await`\nescalates that throw into an **uncatchable** crash.\n\n## Root cause (`lib/dsf/DsfParser.js:34-56`)\n```js\nwhile (bytesRemaining >= ChunkHeader.len) {               // ChunkHeader.len = 12\n  const chunkHeader = await this.tokenizer.readToken(ChunkHeader);   // { id, size }\n  switch (chunkHeader.id) {\n    case 'fmt ': { ...; return; }\n    default: this.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len); break;  // size<12 -> negative, no await\n  }\n  bytesRemaining -= chunkHeader.size;\n}\n```\nstrtok3 `AbstractTokenizer.ignore` (L78-79): `if (length < 0) throw new RangeError('ignore length must be ≥ 0 bytes');`\n\n## Steps to reproduce\n`repro/` — public API only, Node's default unhandled-rejection mode, `try/catch` around the parse:\n```\nnpm install && node poc.mjs\n```\nConfirmed on 11.14.0:\n```\n[app] parseBuffer() RESOLVED — the caller saw no error to catch.\nRangeError: ignore length must be ≥ 0 bytes\n    at DsfParser.parseChunks (.../lib/dsf/DsfParser.js:51)\n   <process exits non-zero — the \"process survived\" line never prints>\n```\n\n## Impact\nDoS: a single crafted `.dsf` (or any file with the `DSD ` magic) crashes the Node process of any\napp parsing untrusted audio with music-metadata (2.2M weekly downloads). The crash bypasses the\ncaller's error handling, so even apps that correctly `try/catch` per-file parsing are killed — one\nmalicious upload can take down a shared server/worker.\n\n## Remediation\nAdd `await` on line 51 (makes the `RangeError` a catchable parse error), and validate\n`chunkHeader.size >= ChunkHeader.len` before the skip (as the ASF fix did; also guards the loop\ncounter). Audit other parsers for un-awaited `tokenizer.ignore()`/`readToken()`.\n\n## Scope / honesty\nRequires the DSF path (a `DSD `-magic file — normal auto-detection). Relies on Node's default\nunhandled-rejection mode (`throw`, default since Node 15); the point is that the standard defensive\nper-parse `try/catch` does not protect against it. Crash (availability), not disclosure/RCE.\nNegatives confirmed alongside: ASF infinite loop fixed; negative-`ignore` infinite-loop class\nclosed at strtok3; unbounded allocation bounded by strtok3's read bound-check.\n\n## Credits\nIssue also reported by @ryu7eroo","state":0,"publishedAt":"2026-10-08T19:40:45+00:00","modifiedAt":"2026-10-08T20:00:05.8602632+00:00","affected":[{"ecosystem":"npm","name":"music-metadata","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"11.15.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j","https://github.com/Borewit/music-metadata/pull/2700","https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41","https://github.com/Borewit/music-metadata","https://github.com/Borewit/music-metadata/releases/tag/v11.15.0"],"sourceUrl":"https://github.com/advisories/GHSA-8j4c-6x6g-rq3j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8j4c-6x6g-rq3j","identifiers":["GHSA-8j4c-6x6g-rq3j","CVE-2026-107392"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T06:04:36.9417469+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T06:04:36.9417469+00:00","lastSuccessAt":"2026-11-10T06:04:37.1495753+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:37.1495759+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-f6cc9b12cdb581c8c26d0d42311ec22aefb7992e88ee12bd79a0c89f476e29ff","complete":true,"records":421887,"lastAttemptAt":"2026-11-10T06:02:15.6675427+00:00","lastSuccessAt":"2026-11-10T06:02:15.5673353+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:02:15.6675427+00:00","snapshotPublishedAt":"2026-11-10T05:23:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T06:05:35.0354037+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T06:04:36.9417469+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T06:04:36.9417469+00:00","lastSuccessAt":"2026-11-10T06:04:37.1503787+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:37.1503789+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dcb6f23f313c40328d8b679af29a76c8","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T06:05:02.8914576+00:00","lastSuccessAt":"2026-11-10T06:05:02.887+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T06:05:02.887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T06:04:29.7401591+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:29.7401591+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T06:02:15.7348582+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:02:15.7348582+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-14f555fdbdce5e9103ab1251a692b612ea1fcd0b3d538af6015a071f4b299249","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T06:04:36.8991666+00:00","lastSuccessAt":"2026-11-10T06:04:36.7449268+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:36.8991666+00:00","snapshotPublishedAt":"2026-11-10T05:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5b9134a1c92c7f3c542fa77c730904ae6f13b772cb6b6707fc58983c93af0933","complete":true,"records":231596,"lastAttemptAt":"2026-11-10T06:04:29.6144485+00:00","lastSuccessAt":"2026-11-10T06:04:28.0373789+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:04:29.6144485+00:00","snapshotPublishedAt":"2026-11-10T05:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}