CVE-2026-25579: 
NixOS vulnerability analysis and mitigation

CVE-2026-25579 is a Denial of Service and disk exhaustion vulnerability in Navidrome, an open-source web-based music collection server and streamer. Authenticated users can crash the server by supplying an excessively large size parameter to the /rest/getCoverArt or /share/img/<token> endpoints, causing uncontrolled memory growth that triggers the Linux OOM killer and terminates the Navidrome process. All versions prior to 0.60.0 are affected. The vulnerability was published on February 4, 2026, and patched in version 0.60.0 released February 3, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 9.2 (Critical) (GitHub Advisory).

The root cause is the absence of any upper-bound validation on the size parameter accepted by the /rest/getCoverArt and /share/img/<token> endpoints, classified under CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-789 (Memory Allocation with Excessive Size Value). In the /rest/getCoverArt handler, the value is read directly as size := p.IntOr("size", 0) and passed without restriction into the image resizing routine, which attempts to allocate memory proportional to the requested dimensions. When an extremely large integer is supplied (e.g., size=300000), the server exhausts available RAM and is terminated by the kernel OOM killer; if sufficient memory exists, the oversized image is written to the cache directory, rapidly consuming disk space. A proof-of-concept is included in the official security advisory (GitHub Advisory).

Successful exploitation results in a full service outage via two mechanisms: memory exhaustion that triggers the Linux OOM killer and terminates the Navidrome process, or disk space exhaustion from oversized cached images that prevents the host from writing logs, operating dependent services, or performing basic system tasks. In severe configurations, the memory allocation attempt may destabilize or crash the entire host system, not just the Navidrome process. There is no confidentiality or integrity impact; the vulnerability is purely an availability threat affecting both the Navidrome service and potentially the underlying host (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the official GitHub Security Advisory, demonstrating the attack with a simple crafted HTTP request. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher yunfachi (GitHub Advisory).

1. Obtain authentication: Log in to a Navidrome instance running a version prior to 0.60.0 to obtain a valid session, or acquire a valid sharing token for a /share/img/<token> URL.
2. Identify a target cover art ID: Send a normal request to /rest/getCoverArt with a small size parameter (e.g., size=300) to confirm the endpoint is functional and identify a valid cover art ID.
3. Craft the malicious request: Replace the size parameter with an extremely large integer, such as size=300000, constructing a request like: GET /rest/getCoverArt?id=<cover_id>&size=300000&square=true
4. Trigger memory exhaustion: Send the crafted request to the server. The image resizing routine attempts to allocate memory for a 300,000×300,000 pixel image, rapidly consuming all available RAM.
5. Achieve DoS: The Linux OOM killer terminates the Navidrome process, resulting in a full service outage. Alternatively, if the system has sufficient RAM, the oversized image is written to the cache directory, exhausting disk space.
6. Repeat via shared image URL (optional): If a valid sharing token is available, the same attack can be performed unauthenticated via /share/img/<token>?size=300000&square=true (GitHub Advisory).

• Network: HTTP GET requests to /rest/getCoverArt or /share/img/<token> with abnormally large size parameter values (e.g., size values in the tens or hundreds of thousands).
• Logs: Navidrome access logs showing repeated requests to /rest/getCoverArt or /share/img/ endpoints with large size values; kernel OOM killer log entries (e.g., Out of memory: Kill process <pid> (navidrome)) in /var/log/syslog or dmesg.
• File System: Unexpectedly large files in Navidrome's cache directory (e.g., image files with sizes in the gigabytes); rapid growth of disk usage in the Navidrome cache path.
• Process: Sudden termination of the Navidrome process without a graceful shutdown; service restart events logged by the process supervisor (e.g., systemd reporting Navidrome as failed/restarted) (GitHub Advisory).

Upgrade Navidrome to version 0.60.0 or later, which fixes the vulnerability by clamping the requested square size to the original image dimensions, preventing excessive memory allocation (Navidrome v0.60.0). If immediate patching is not possible, implement network-level controls (e.g., a reverse proxy or WAF rule) to reject requests to /rest/getCoverArt and /share/img/ endpoints where the size parameter exceeds a reasonable threshold (e.g., 2000). Additionally, rate limiting on these endpoints can reduce the risk of rapid disk exhaustion (GitHub Advisory).

The vulnerability was credited to researcher yunfachi, who reported it responsibly to the Navidrome project. The fix was included in the v0.60.0 release alongside another security fix for a potential XSS vulnerability (GHSA-rh3r-8pxm-hg4w), indicating a coordinated security release. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication (GitHub Advisory, Navidrome v0.60.0).