{"action":"Upgrade music-metadata to 11.16.0 or later.","affected":[{"fixed":"11.16.0","introduced":"0"}],"component":"music-metadata","cve_ids":["CVE-2026-107391"],"ecosystem":"npm","epss":0.00316,"exploited":false,"fixed_versions":["11.16.0"],"ghsa_id":"GHSA-f94x-6692-553q","id":"tcs_01M5KFN3RW0K67590P5B9XVFZH","modified_at":"2026-10-08T20:00:05.866283095Z","published_at":"2026-10-08T19:43:25Z","references":["https://osv.dev/vulnerability/GHSA-f94x-6692-553q","https://github.com/Borewit/music-metadata/security/advisories/GHSA-f94x-6692-553q","https://github.com/Borewit/music-metadata/pull/2734","https://github.com/Borewit/music-metadata/commit/90a7d52c69e921a0b019592d887acd97b1c8b8a5","https://github.com/Borewit/music-metadata","https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-f94x-6692-553q","url":"https://osv.dev/vulnerability/GHSA-f94x-6692-553q"}],"summary":"music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master"}