CVE-2026-107392
1 advisory.
npm/music-metadata CVE-2026-107392: medium 6.2, EPSS 0.36%
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
Action: Upgrade music-metadata to 11.15.0 or later.
npm i music-metadata@11.15.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 11.15.0 | - |
Fixed versions
| 11.15.0 |
Sources
- osv: GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
CVE-2026-107392 · published · modified · JSON