Threats affecting pkg:npm/music-metadata

A resource consumption vulnerability exists in Borewit's music-metadata library prior to version 11.16.0. The flaw occurs in the MP4 stsd sample-description parser where an attacker can craft an MP4 input with a zero sample-entry size and a controlled entry_count, causing an infinite synchronous loop. This leads to blocking the Node.js event loop and potentially exhausting system memory. The issue was introduced after version 11.14.0 and fixed in version 11.16.0.

A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows an attacker to cause excessive memory allocation by providing a crafted MP4 file with an oversized 64-bit extended atom size. This can lead to denial of service due to process failure or resource exhaustion during parsing of certain MP4 atoms. The issue is fixed in version 11.16.0.

A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows excessive memory allocation due to trusting the syncsafe tag-size field in ID3v2 tags. This can cause the parser to allocate up to approximately 268 MiB of memory for a truncated file, leading to a denial of service condition. The issue is fixed in version 11.16.0.

music-metadata version 11.15.0 contains a vulnerability in its APEv2 tag parser where it allocates memory based on an untrusted size value without verifying that the declared size fits within the actual file data. This can lead to excessive memory allocation and potential denial of service. The issue is limited to availability impact and does not affect confidentiality or integrity. The vulnerability is fixed in versions after 11.15.0.

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.