music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

{
  "id": "08bdef9a4f5e708a32653571c9a618851a8fd5bc70606f951f3472eb37b7c739",
  "url": "https://osv.dev/vulnerability/GHSA-f94x-6692-553q",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master",
    "summary": "### Summary `StsdAtom.get()` in `lib/mp4/AtomToken.ts` parses an MP4 `stsd` (sample description) box's entry table by advancing a cursor with `off += size - 4`, where `size` is a 32-bit, attacker-controlled per-entry length read straight from the file. When `size == 0`, that advance is `0`, so a file declaring a huge `entry_count` and a first entry `size` of `0` spins forever: same bytes read every iteration, no progress, no exit. Because `StsdAtom.get` runs *synchronously* inside `strtok3`'s tokenizer, this doesn't just fail slowly — it blocks the Node.js event loop entirely for the whole process. A 48-byte file is enough to hang any service that parses user-uploaded audio/video metadata through `parseBuffer`, `parseFile`, `parseStream`, `parseBlob`, or `parseWebStream`. This is currently unreleased — present on the `master` branch only, not in the latest npm release (`11.14.0`) or any earlier one. Reporting now, before it ships. ### Details `lib/mp4/AtomToken.ts`, `StsdAtom.get()`: ```ts for (let n = 0; n < header.numberOfEntries; ++n) { const size = Token.UINT32_BE.get(buf, off); // attacker-controlled entry size off += Token.UINT32_BE.len; // +4 (skip the size field) table.push(new SampleDescriptionTable(size - Token.UINT32_BE.len).get(buf, off)); off += size - Token.UINT32_BE.len; // net advance = size - 4 } ``` - Introduced by commit `d2a7d6f` (\"fix(mp4): locate each sample entry after the first correctly\", merged via PR #2693, fixing issue #2691, 2026-08-03). Before th",
    "evidence": "osv:GHSA-f94x-6692-553q",
    "products": [
      {
        "name": {
          "value": "music-metadata",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "11.16.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-f94x-6692-553q",
      "aliases": [
        "CVE-2026-107391",
        "GHSA-f94x-6692-553q"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "11.16.0"
                }
              ]
            }
          ],
          "package": {
            "name": "music-metadata",
            "purl": "pkg:npm/music-metadata",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f94x-6692-553q/GHSA-f94x-6692-553q.json"
          }
        }
      ],
      "modified": "2026-10-08T20:00:05.866283095Z",
      "provider": "osv",
      "references": [
        "https://github.com/Borewit/music-metadata/security/advisories/GHSA-f94x-6692-553q",
        "https://github.com/Borewit/music-metadata/pull/2734",
        "https://github.com/Borewit/music-metadata/commit/90a7d52c69e921a0b019592d887acd97b1c8b8a5",
        "https://github.com/Borewit/music-metadata",
        "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400",
          "CWE-835"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-08T19:43:25Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107391",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 104572,
  "published_at": "2026-10-08T19:43:25+00:00"
}