CVE-2026-32256: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32256 is an infinite loop vulnerability in the ASF (Advanced Systems Format) parser of the music-metadata npm package, a widely used audio/video metadata parser with approximately 2.2 million weekly downloads. The vulnerability exists in parseExtensionObject() (located in lib/asf/AsfParser.ts:112-158) and is triggered when a sub-object inside the ASF Header Extension Object has objectSize = 0, causing the parser to hang indefinitely. All versions prior to 11.12.3 are affected; version 11.12.3 resolves the issue. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Vendor Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition). When a sub-object's objectSize is 0, the calculation remaining = 0 - 24 = -24 causes tokenizer.ignore(-24) to move the read position backward by 24 bytes — a behavior permitted by strtok3's AbstractTokenizer.ignore(), which does not validate negative values. As a result, extensionSize -= 0 never decrements the loop counter, and the while (extensionSize > 0) condition never becomes false, re-reading the same 24-byte header infinitely. The vulnerability affects parseFile() and parseBuffer() (which inherit the vulnerable ignore() from AbstractTokenizer), but not parseStream(), which uses ReadStreamTokenizer and throws a RangeError on negative values. This follows the same pattern as CVE-2026-31808 in the file-type package (Github Advisory, Vendor Advisory).

Successful exploitation causes a permanent hang (denial of service) in any application that calls parseFile() or parseBuffer() on a crafted .asf file. No authentication or user interaction is required, and the attack can be delivered remotely by supplying a malicious media file — for example, through a file upload endpoint or media processing pipeline. There is no confidentiality or integrity impact; the sole consequence is complete availability loss for the affected process or service. Given the library's 2.2 million weekly npm downloads, the potential blast radius across dependent applications is significant (Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.013% (0.021% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity — requiring only a crafted ~100-byte .asf file with no privileges or user interaction — makes it straightforward to weaponize against exposed media processing services (Github Advisory, Vendor Advisory).

1. Craft malicious ASF file: Create a minimal (~100-byte) .asf file containing an ASF Header Extension Object with a sub-object where objectSize is set to 0. This can be done with a hex editor or a custom script targeting the ASF binary format.
2. Identify target: Locate an application or service that uses music-metadata (versions ≤ 11.12.1) and accepts user-supplied audio/video files for metadata parsing via parseFile() or parseBuffer() — such as a media upload API, music streaming backend, or podcast platform.
3. Submit the crafted file: Upload or submit the malicious .asf file to the target service through any available input channel (e.g., HTTP file upload, API endpoint).
4. Trigger infinite loop: When the application calls parseFile() or parseBuffer() on the crafted file, the ASF parser enters an infinite loop, permanently hanging the processing thread or worker.
5. Achieve denial of service: The hung process consumes CPU and/or blocks the event loop (in Node.js environments), degrading or completely disrupting service availability. Repeated submissions can exhaust all available workers (Github Advisory, Vendor Advisory).

• Process: Node.js worker or process stuck at 100% CPU utilization for an extended period with no progress; process unresponsive to normal termination signals.
• Logs: Application logs showing a metadata parsing request for an .asf file that never completes or times out; absence of a completion log entry following an ASF file parse initiation.
• Network: Repeated uploads of small (≈100-byte) .asf files from the same source IP, particularly if followed by service degradation.
• File System: Presence of anomalously small .asf files (under 200 bytes) in upload or temporary directories, which are not valid media files (Github Advisory).

Upgrade music-metadata to version 11.12.3 or later, which validates objectSize to prevent the infinite loop condition. As a short-term workaround where upgrading is not immediately possible, avoid processing untrusted .asf files with parseFile() or parseBuffer(); use parseStream() instead, as ReadStreamTokenizer throws a RangeError on negative ignore values and is not affected. Additionally, implement file size and format validation at ingestion boundaries to reject anomalously small or malformed .asf files before they reach the parser (Github Advisory, Release Notes).

The vulnerability was reported by security researcher ByamB4 and disclosed by the maintainer (Borewit) via GitHub Security Advisories on March 17, 2026. Community discussion noted the similarity to CVE-2026-31808 in the file-type package, highlighting a recurring pattern in strtok3's AbstractTokenizer.ignore() accepting negative values without validation. Social media activity was limited, with a mention on Mastodon via @thehackerwire shortly after disclosure (Github Advisory, Vendor Advisory).