CVE-2026-107387: 
JavaScript vulnerability analysis and mitigation

CVE-2026-107387 is an uncontrolled memory allocation vulnerability in the APEv2 parser of the music-metadata npm package (by Borewit), a widely used metadata parser for audio and video files. The flaw affects all versions up to and including 11.12.3 (with 11.15.0 also confirmed vulnerable), and is fixed in version 11.16.0. It was first published to the GitHub Advisory Database on September 23, 2026, and reviewed on October 8, 2026. The vulnerability carries a CVSS v3.1 base score of 6.2 (Moderate) per the GitHub Advisory, or 5.5 (Medium) per NVD scoring (Github Advisory, Feedly).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value). In lib/apev2/APEv2Parser.ts, the parser reads a tag-item size field directly from attacker-controlled input via Token.UINT32_LE.get(buf, off) and immediately allocates a Uint8Array of that size — for example, const picData = new Uint8Array(tagItemHeader.size) — before verifying that the declared size fits within the remaining tag or file data. This means a crafted 134-byte .ape file with a cover-art tag item declaring a size of 0x08000000 (128 MiB) forces a 128 MiB heap allocation; the parser only throws an EndOfStreamError after the allocation has already occurred. Repeated or concurrent parsing of such files can exhaust Node.js process memory. A full proof-of-concept script (poc-apev2-memory.mjs) is included in the security advisory (Github Advisory, Security Advisory).

The sole demonstrated impact is availability loss (denial of service). An attacker who can supply a crafted .ape file to an application using music-metadata can cause the Node.js process to allocate up to 128 MiB per parse invocation; concurrent or repeated requests can multiply this effect and exhaust all available process memory, crashing or hanging the service. There is no demonstrated confidentiality or integrity impact — no data exfiltration, code execution, or privilege escalation is possible through this vulnerability (Github Advisory, Security Advisory).

A public proof-of-concept (poc-apev2-memory.mjs) is embedded in the official security advisory and demonstrates the full attack with a 134-byte payload causing a 128 MiB allocation (Github Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.19% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation status as "poc" and automation as "no" (Feedly).

1. Identify a target: Find an application that accepts user-supplied .ape audio files and processes them with music-metadata versions prior to 11.16.0 (e.g., a music streaming service, media management tool, or file upload endpoint).
2. Construct the malformed APE file: Build a minimal APEv2-tagged APE file structure in JavaScript using the published PoC. Assemble an APE frame descriptor (MAC header), an audio header, and an APEv2 tag footer (APETAGEX) specifying a tag size of 2000 bytes.
3. Embed an oversized tag item declaration: Create an APEv2 tag item with the size field set to 0x08000000 (128 MiB) and the key Cover Art (Front)\0, but provide no actual data bytes. The total crafted payload is only 134 bytes.
4. Submit the crafted file: Upload or otherwise deliver the 134-byte .ape payload to the target application so that it is parsed by music-metadata (e.g., via parseBuffer(payload, { mimeType: 'audio/ape' })).
5. Trigger unvalidated allocation: The APEv2 parser reads the 128 MiB size field and allocates new Uint8Array(0x08000000) before checking whether the file contains that many bytes. An EndOfStreamError is thrown, but the 128 MiB allocation has already occurred.
6. Repeat or parallelize: Send multiple concurrent requests with the crafted file to multiply the memory impact and exhaust the Node.js process heap, causing a crash or service outage (Github Advisory, Security Advisory).

• Logs: Repeated EndOfStreamError: End-Of-Stream exceptions originating from lib/apev2/APEv2Parser.ts in application logs, especially when processing .ape files from untrusted sources.
• Process/Memory: Sudden, disproportionate spikes in Node.js heap or arrayBuffers memory usage (e.g., 128 MiB increments per parse call) observable via process.memoryUsage() or system monitoring tools; out-of-memory (OOM) kills of the Node.js process.
• File System: Presence of small (≈134-byte) .ape files in upload directories or temporary storage that do not correspond to valid audio content.
• Network: High-frequency or concurrent upload requests delivering .ape files of unusually small size (under 200 bytes) to media parsing endpoints (Github Advisory).

Upgrade music-metadata to version 11.16.0 or later, which adds bounds validation in APEv2Parser.ts to reject tag item sizes exceeding remaining tag or file data before any allocation occurs, and introduces bounded chunked reading for large tag values (v11.16.0 Release, Fix PR). If immediate patching is not possible, restrict or disable parsing of untrusted .ape files, enforce memory limits on the Node.js process (e.g., --max-old-space-size), and implement request-rate limiting and parsing timeouts for audio file processing endpoints. Monitor for abnormal memory usage patterns when handling audio files from untrusted sources.

The vulnerability was reported by researcher "Zwique" and addressed promptly by the maintainer (Borewit), who merged the fix PR on September 22, 2026 — one day before the advisory was published — and released version 11.16.0 with multiple concurrent security fixes for APEv2, MP4, EBML, and ID3v2 parsers (v11.16.0 Release, Fix PR). No significant broader media coverage or notable social media reactions have been identified beyond the GitHub advisory and standard vulnerability database aggregators.