CVE-2026-107392: 
JavaScript vulnerability analysis and mitigation

CVE-2026-107392 is a Denial of Service vulnerability in the music-metadata npm package (by Borewit) affecting all versions up to and including 11.14.0. The DSF parser's parseChunks method calls tokenizer.ignore() without awaiting the returned promise and without validating that the chunk size is at least 12 bytes (the chunk header length), allowing a crafted DSF file to produce a negative ignore length that triggers an uncatchable RangeError process crash. The vulnerability was published on August 18, 2026, and added to the GitHub Advisory Database on October 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 6.2 (Moderate) per the GitHub Advisory (Github Advisory, Feedly).

The root cause is classified as CWE-248 (Uncaught Exception) and CWE-400 (Uncontrolled Resource Consumption). In lib/dsf/DsfParser.js (lines 34–56), the parseChunks loop reads a chunk header and, for any unrecognized chunk ID (not 'fmt '), calls this.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len) without await. When a crafted DSF chunk has a size field between 0 and 11 (less than the 12-byte ChunkHeader.len), the argument becomes negative. With strtok3 ≥ 10.3.5, AbstractTokenizer.ignore() throws a RangeError('ignore length must be ≥ 0 bytes') synchronously; because the call is fire-and-forget (no await), the rejection detaches from the parseBuffer() promise chain and becomes an unhandled rejection. Under Node.js ≥ 15 default behavior, unhandled rejections terminate the process — crucially, after parseBuffer() has already resolved, so any surrounding try/catch block in the calling application sees no error and cannot prevent the crash. This is a residual of GHSA-v6c2-xwv6-8xf7, where the analogous ASF parser site was fixed in v11.12.3 but the DSF site was overlooked (Github Advisory, Fix PR).

The sole demonstrated impact is availability loss (Denial of Service) — there is no confidentiality or integrity impact. A single malicious DSF upload to any application using music-metadata (which has approximately 2.2 million weekly npm downloads) can crash the entire Node.js process, taking down all concurrent operations on a shared server or worker. Because the crash bypasses the caller's per-parse try/catch error handling, even defensively coded applications are vulnerable, making this particularly dangerous in multi-tenant or shared-hosting environments that accept user-supplied audio files (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory (GHSA-8j4c-6x6g-rq3j), with concrete reproduction steps (npm install && node poc.mjs) and confirmed crash output on version 11.14.0 (Github Advisory). The EPSS score is approximately 0.20–0.36% (28th percentile), indicating a low but non-negligible probability of exploitation in the wild within 30 days. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication and no user interaction beyond delivering a crafted DSF file to the target application, but does require the application to be running Node.js ≥ 15 with default unhandled rejection behavior (Feedly).

1. Craft malicious DSF file: Create a binary file beginning with the DSD magic signature ('DSD '), followed by a valid DSD chunk, then a non-'fmt ' chunk header where the size field is set to a value between 0 and 11 (e.g., size = 4). This makes Number(chunkHeader.size) - 12 evaluate to a negative number (e.g., -8).
2. Deliver the file to the target application: Upload or otherwise supply the crafted .dsf file to any application that uses music-metadata for audio parsing — for example, via a file upload endpoint, HTTP POST, or any other input channel that feeds files to the library.
3. Trigger parsing: The application calls parseBuffer() (or equivalent) on the crafted file. DsfParser.parseChunks() reads the malformed chunk header and enters the default switch case.
4. Trigger the unawaited rejection: this.tokenizer.ignore(Number(chunkHeader.size) - ChunkHeader.len) is called with a negative argument. strtok3 (≥ 10.3.5) throws RangeError: ignore length must be ≥ 0 bytes. Because there is no await, the rejection is detached from the parseBuffer() promise chain.
5. Bypass error handling: parseBuffer() resolves normally and returns to the caller. The caller's try/catch block sees no error and does not execute any recovery logic.
6. Crash the process: Node.js ≥ 15 default unhandled rejection handler terminates the process with a non-zero exit code, causing a full Denial of Service. The crash output includes the RangeError stack trace pointing to DsfParser.parseChunks (Github Advisory).

• Process: Node.js process terminating unexpectedly with a non-zero exit code; crash output containing RangeError: ignore length must be ≥ 0 bytes with a stack trace referencing DsfParser.parseChunks in lib/dsf/DsfParser.js:51.
• Logs: Application logs showing parseBuffer() completing successfully (resolved) immediately before an unhandled rejection crash; Node.js unhandled rejection warning/error logs referencing strtok3 AbstractTokenizer.ignore.
• File System: Presence of uploaded .dsf files (or files with DSD magic bytes 44 53 44 20 at offset 0) with chunk size fields smaller than 12 bytes in the file upload directory.
• Network: Repeated HTTP requests uploading small or malformed .dsf files to audio parsing endpoints, particularly if followed by application restarts or 502/503 errors indicating process crashes (Github Advisory).

Upgrade music-metadata to version 11.15.0 or later, which adds await to the tokenizer.ignore() call and validates that chunkHeader.size >= ChunkHeader.len before processing, making the RangeError catchable within the parser promise chain (Fix PR, Release v11.15.0). If immediate patching is not possible, implement input validation to reject files with the DSD magic signature ('DSD ') before passing them to music-metadata, or disable DSF/DSD file parsing entirely if not required. Additionally, consider configuring a Node.js process manager (e.g., PM2, systemd) to automatically restart crashed workers as a resilience measure while patching is pending (Github Advisory).

The advisory was authored and published by the library maintainer (Borewit) on August 18, 2026, with credit to reporter @EchoSkorJjj and co-reporter @ryu7eroo. The maintainer explicitly noted the vulnerability as a residual of a prior advisory (GHSA-v6c2-xwv6-8xf7) where the analogous ASF parser path was fixed but the DSF path was missed, demonstrating proactive transparency. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and standard vulnerability database aggregation (Github Advisory).