music-metadata: uncatchable process crash parsing a crafted .dsf (residual of GHSA-v6c2-xwv6-8xf7)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.2 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-107392: 0.36% estimated exploitation activity in the next 30 days; percentile 29.30 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument negative; strtok3 (≥ 10.3.5) throws RangeError on a negative ignore. Because the call is fire-and-forget, the rejection is detached from the parseBuffer() promise chain → unhandled rejection → Node's default (≥ 15) crashes the process — after parseBuffer() already resolved, so a caller's try/catch catches nothing and is still taken down. Residual of GHSA-v6c2-xwv6-8xf7: the ASF site was fixed in 11.12.3 (size validation) and strtok3 now throws on negative ignore; the DSF site was never validated, and its missing await escalates that throw into an uncatchable crash. Root cause (lib/dsf/DsfParser.js:34-56) strtok3 AbstractTokenizer.ignore (L78-79): if (length < 0) throw new RangeError('ignore length must be ≥ 0 bytes'); Steps to reproduce repro/ — public API only, Node's default…

Published by the source

8 Oct 2026, 19:40 UTC

Last modified by the source

8 Oct 2026, 20:00 UTC

Source last checked

26 Oct 2026, 13:07 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-8j4c-6x6g-rq3j

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-8j4c-6x6g-rq3j

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-8j4c-6x6g-rq3j

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-107392

Advisory: music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
IDs: CVE-2026-107392, GHSA-8j4c-6x6g-rq3j
Record: https://patchnext.com/advisories/cve-2026-107392 (revision 3, source checked 26 Oct 2026, 13:07 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.2)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: music-metadata 11.15.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm music-metadata: affected <= 11.14.0; fixed in 11.15.0

## Suggested inspection (read-only)
- `npm ls music-metadata --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on music-metadata.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-8j4c-6x6g-rq3j (GitHub-reviewed advisory GHSA-8j4c-6x6g-rq3j lists affected ranges: npm music-metadata >=0 <=11.14.0)
- Verified: https://osv.dev/vulnerability/GHSA-8j4c-6x6g-rq3j (OSV record GHSA-8j4c-6x6g-rq3j lists affected ranges: npm music-metadata >=0 <11.15.0 (fixed))

Commands are suggestions: review each one before running it.