CVE-2026-32256 music-metadata has an infinite loop vulnerability in ASF parser

What is CVE-2026-32256?

CVE-2026-32256 is a high-severity denial of service vulnerability in Borewit music-metadata, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.

Weakness: CWE-835

Which versions are affected by CVE-2026-32256?

2 open source packages ship an affected version, including music-metadata. It affects 1 product.

Products include Borewit Music-Metadata.

How do I fix CVE-2026-32256?

Upgrade music-metadata to 11.12.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-32256 being exploited?

There is no known exploitation of CVE-2026-32256 in the wild and no public exploit code.

Other vulnerabilities in Borewit music-metadata

• CVE-2026-107387 music-metadata: Uncontrolled memory allocation in APEv2 parser Medium 6.2
• CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS Medium 6.2
• CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort Medium 6.2
• CVE-2026-107390 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length Medium 6.2
• CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master Medium 6.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v6c2-xwv6-8xf7, MINI-4pmg-2rrh-997j.