CVE-2026-32256: Borewit Music-metadata DOS Vulnerability

CVE-2026-32256 Overview

CVE-2026-32256 is an infinite loop vulnerability affecting music-metadata, a popular metadata parser for audio and video media files. The vulnerability exists in the ASF (Advanced Systems Format) parser, specifically within the parseExtensionObject() function in lib/asf/AsfParser.ts. When processing a maliciously crafted ASF file containing a sub-object inside the ASF Header Extension Object with objectSize = 0, the parser enters an infinite loop, leading to a denial of service condition.

Critical Impact

Applications using vulnerable versions of music-metadata can be crashed or rendered unresponsive by processing a specially crafted ASF media file, potentially disrupting media processing services and content management systems.

Affected Products

• borewit music-metadata versions prior to 11.12.3

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-32256 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32256

Vulnerability Analysis

This vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw resides in the ASF parser component of music-metadata, which is responsible for extracting metadata from Windows Media Audio (WMA), Windows Media Video (WMV), and other ASF-based media files.

The vulnerable code path is triggered when the parser encounters an ASF Header Extension Object containing a sub-object with a zero-length size field. The parsing logic fails to properly validate the objectSize parameter before using it to advance through the file structure. When objectSize = 0, the parser's position never advances, causing it to repeatedly process the same malformed object indefinitely.

This vulnerability can be exploited remotely if an application accepts ASF files from untrusted sources for metadata extraction, making it particularly dangerous for web applications, media servers, and content management systems that process user-uploaded media files.

Root Cause

The root cause is insufficient input validation in the parseExtensionObject() function located at lines 112-158 of lib/asf/AsfParser.ts. The parser does not verify that sub-object sizes are non-zero before attempting to iterate through the extension object's contents. When a sub-object declares a size of zero bytes, the parsing loop continues indefinitely because the file position indicator never progresses past the malformed object.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious ASF file with a specially constructed Header Extension Object. The attack requires no authentication and can be delivered through any mechanism that allows file upload or processing:

1. The attacker creates an ASF file with a Header Extension Object
2. Within this extension object, a sub-object is defined with objectSize set to 0
3. When the vulnerable application attempts to parse this file's metadata, the parseExtensionObject() function enters an infinite loop
4. The application becomes unresponsive, consuming CPU resources indefinitely until forcibly terminated

The vulnerability is exploitable over the network (AV:N) with no privileges required (PR:N) and no user interaction necessary (UI:N) beyond the initial file upload or processing trigger.

Detection Methods for CVE-2026-32256

Indicators of Compromise

• Application processes consuming 100% CPU while parsing ASF/WMA/WMV files
• Unresponsive media processing services or endpoints
• Timeout errors in media metadata extraction operations
• Presence of malformed ASF files with zero-size extension sub-objects in upload directories

Detection Strategies

• Monitor for abnormally long-running metadata extraction operations that exceed expected processing times
• Implement resource consumption monitoring for services utilizing music-metadata library
• Deploy application-level timeouts to detect and terminate infinite loop conditions
• Review application logs for repeated parsing attempts on the same file without completion

Monitoring Recommendations

• Configure process monitoring to alert on sustained high CPU usage by Node.js applications using music-metadata
• Implement request timeout thresholds for media file processing endpoints
• Enable structured logging for metadata parsing operations to identify problematic files
• Monitor file upload endpoints for repeated submissions of ASF-format files

How to Mitigate CVE-2026-32256

Immediate Actions Required

• Upgrade music-metadata to version 11.12.3 or later immediately
• Audit applications to identify all instances where music-metadata is used to process untrusted media files
• Implement file processing timeouts as a defense-in-depth measure
• Consider temporarily disabling ASF file processing if immediate patching is not possible

Patch Information

The vulnerability has been fixed in music-metadata version 11.12.3. The fix adds proper validation to ensure sub-object sizes are non-zero before processing, preventing the infinite loop condition. Users should update their dependencies to this version or later.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-v6c2-xwv6-8xf7 and the GitHub Release v11.12.3.

Workarounds

• Implement file type restrictions to reject ASF/WMA/WMV files if they are not required by your application
• Add processing timeouts at the application level to terminate operations that exceed reasonable duration thresholds
• Deploy the application behind a reverse proxy with request timeout configurations
• Validate uploaded files using alternative methods before passing them to music-metadata for parsing

# Update music-metadata to the patched version
npm update music-metadata@11.12.3

# Or explicitly install the fixed version
npm install music-metadata@11.12.3