navidrome vulnerabilities (Alpine)

5 vulnerabilities.

• navidrome Alpine Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints CVE-2026-25579 Fix available 9.2 CriticalFebruary 4, 2026
• navidrome Alpine Navidrome is vulnerable to XSS via comment from song metadata CVE-2026-25578 Fix available 6.1 MediumFebruary 4, 2026
• navidrome Alpine Navidrome Transcoding Permission Bypass Vulnerability Report CVE-2025-48948 Fix available 7.4 HighMay 29, 2025
• navidrome Alpine Navidrome allows SQL Injection via role parameter CVE-2025-48949 Fix available 8.9 HighMay 29, 2025
• navidrome Alpine SQL injection in github.com/navidrome/navidrome CVE-2022-23857 Fix available 6.5 MediumJanuary 24, 2022