CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
Authenticated users can crash the Navidrome server or exhaust disk space by requesting oversized cover art images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25579?
CVE-2026-25579 is a critical denial of service vulnerability in navidrome, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
Which versions are affected by CVE-2026-25579?
3 open source packages ship an affected version, including github.com/navidrome/navidrome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/navidrome/navidrome Go | All versions | 0.60.0 |
github.com/navidrome/navidrome Go | All versions | 0.60.0 |
github.com/navidrome/navidrome Go | All versions | 0.60.0 |
Products include Navidrome Navidrome.
How do I fix CVE-2026-25579?
Upgrade github.com/navidrome/navidrome to 0.60.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25579 being exploited?
There is no known exploitation of CVE-2026-25579 in the wild and no public exploit code.
Other vulnerabilities in navidrome
- CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
- CVE-2024-41259 Navidrome uses MD5 hashing algorithm
- CVE-2025-48949 Navidrome allows SQL Injection via role parameter
- CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint
- CVE-2025-48948 Navidrome Transcoding Permission Bypass Vulnerability Report
Sources
Also known as GHSA-hrr4-3wgr-68x3, GO-2026-4411.