CVE-2026-32256
📋 TL;DR
CVE-2026-32256 is an infinite loop vulnerability in music-metadata's ASF parser that occurs when processing malformed ASF media files with sub-objects having objectSize=0. This allows attackers to cause denial of service by making applications hang or consume excessive resources. Any application using vulnerable versions of music-metadata to parse ASF files is affected.
💻 Affected Systems
- music-metadata
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete application unresponsiveness leading to denial of service, potentially affecting entire systems if the application runs with high privileges or handles critical functions.
Likely Case
Application hangs or crashes when processing malicious ASF files, causing service disruption for users processing media files.
If Mitigated
Limited impact with proper input validation and resource limits, though some performance degradation may occur.
🎯 Exploit Status
Exploitation requires only a specially crafted ASF file. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.12.3
Vendor Advisory: https://github.com/Borewit/music-metadata/security/advisories/GHSA-v6c2-xwv6-8xf7
Restart Required: Yes
Instructions:
1. Update music-metadata package: npm update music-metadata@11.12.3
2. Restart all applications using music-metadata
3. Verify the update with: npm list music-metadata
🔧 Temporary Workarounds
Input validation for ASF files
allImplement file validation to reject or limit processing of ASF files before they reach the vulnerable parser
Resource limiting
allConfigure process timeouts and memory limits to prevent infinite loops from consuming excessive resources
node --max-old-space-size=512 your-app.js
🧯 If You Can't Patch
- Implement strict file type validation to block ASF files from being processed
- Deploy monitoring for application hangs and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list music-metadata | grep music-metadataCheck Version:
npm list music-metadata | grep music-metadataVerify Fix Applied:
Confirm version is 11.12.3 or higher with: npm list music-metadata📡 Detection & Monitoring
Log Indicators:
- Application hangs or crashes when processing media files
- High CPU usage spikes without completion
- Process timeouts during file parsing
Network Indicators:
- Increased uploads of media files followed by service degradation
- ASF file uploads to media processing endpoints
SIEM Query:
source="application.log" AND ("hang" OR "timeout" OR "high cpu") AND "media" AND "parse"