CVE-2026-107389

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0

Description The Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or an uncatchable V8 fatal abort when using the parseFile() function on Node.js 26.7.0. The failure mode varies by tokenizer, parser API, and runtime, but the flaw in leaf-length validation impacts availability.

Recommendations Update to version 11.16.0.