Threats affecting pkg:hex/membrane_mp4_plugin

CVE-2026-53423 is a medium severity vulnerability in membraneframework's membrane_mp4_plugin before version 0.36.7. It involves allocation of resources without limits or throttling, where the MP4 box header parser converts each 4-byte box name into a BEAM atom without validation. Because BEAM atoms are never garbage-collected, an attacker can craft an MP4 file with many unique box names to exhaust the atom table, causing a denial-of-service by aborting the entire BEAM node and impacting all applications running on it.