https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-107392.htmlhttps://patchthecve.com/cve/CVE-2026-107392.htmlTue, 13 Oct 2026 19:35:27 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input cahttps://patchthecve.com/cve/CVE-2026-107391.htmlhttps://patchthecve.com/cve/CVE-2026-107391.htmlTue, 13 Oct 2026 19:39:28 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from https://patchthecve.com/cve/CVE-2026-107390.htmlhttps://patchthecve.com/cve/CVE-2026-107390.htmlWed, 14 Oct 2026 15:55:12 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fithttps://patchthecve.com/cve/CVE-2026-107389.htmlhttps://patchthecve.com/cve/CVE-2026-107389.htmlWed, 21 Oct 2026 15:34:25 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input.https://patchthecve.com/cve/CVE-2026-107388.htmlhttps://patchthecve.com/cve/CVE-2026-107388.htmlWed, 14 Oct 2026 03:17:14 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request ahttps://patchthecve.com/cve/CVE-2026-107387.htmlhttps://patchthecve.com/cve/CVE-2026-107387.htmlTue, 13 Oct 2026 14:35:46 +0000MEDIUM 6.2: music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can t