Navidrome vulnerabilities

Products

• Navidrome 11

Newest

• navidrome Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints CVE-2026-25579 Fix available 9.2 CriticalFebruary 4, 2026
• navidrome Navidrome is vulnerable to XSS via comment from song metadata CVE-2026-25578 Fix available 6.1 MediumFebruary 4, 2026
• navidrome Navidrome Transcoding Permission Bypass Vulnerability Report CVE-2025-48948 Fix available 7.4 HighMay 29, 2025
• navidrome Navidrome allows SQL Injection via role parameter CVE-2025-48949 Fix available 8.9 HighMay 29, 2025
• navidrome Navidrome has authentication bypass in Subsonic API with non-existent username CVE-2025-27112 Fix available 6.9 MediumFebruary 24, 2025
• navidrome Navidrome Stores JWT Secret in Plaintext in navidrome.db CVE-2024-56362 Fix available 7.1 HighDecember 23, 2024
• navidrome Multiple SQL Injections and ORM Leak in navidrome CVE-2024-47062 Public exploitFix available 9.4 CriticalSeptember 20, 2024
• navidrome Navidrome uses MD5 hashing algorithm CVE-2024-41259 9.1 CriticalAugust 1, 2024
• navidrome Parameter Tampering vulnerability in Navidrome CVE-2024-32963 Fix available 4.2 MediumMay 1, 2024
• navidrome Authentication bypass vulnerability in navidrome's subsonic endpoint CVE-2023-51442 Fix available 8.6 HighDecember 19, 2023
• navidrome SQL injection in github.com/navidrome/navidrome CVE-2022-23857 Fix available 6.5 MediumJanuary 24, 2022