{"action":"Upgrade music-metadata to 11.16.0 or later.","affected":[{"fixed":"11.16.0","introduced":"0"}],"component":"music-metadata","cve_ids":["CVE-2026-107389"],"ecosystem":"npm","epss":0.00214,"exploited":false,"fixed_versions":["11.16.0"],"ghsa_id":"GHSA-5gfj-9q3v-qfp3","id":"tcs_01M5KF3NVJ9EX1M0DFD880KEAH","modified_at":"2026-10-08T20:00:05.878232877Z","published_at":"2026-10-08T19:43:09Z","references":["https://osv.dev/vulnerability/GHSA-5gfj-9q3v-qfp3","https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3","https://github.com/Borewit/music-metadata/pull/2735","https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58","https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df","https://github.com/Borewit/music-metadata","https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-5gfj-9q3v-qfp3","url":"https://osv.dev/vulnerability/GHSA-5gfj-9q3v-qfp3"}],"summary":"music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort"}