GHSA-jjpr-9cvf-cq55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

• npm music-metadata: < 11.16.0 → fixed in 11.16.0

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error. --- Details Vulnerable Code Path: • `lib/id3v2/ID3v2Token.ts:108` - Syncsafe size read without validation • `lib/id3v2/ID3v2Parser.ts:122` - Full tag body allocated before reading • `lib/id3v2/AbstractID3Parser.ts:22` - Allocation happens before stream validation Root Cause: The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking: 1. If the tag size exceeds the remaining file size 2. If the tag size exceeds a reasonable maximum 3. If the subsequent read will actually succeed ```typescript // ID3v2Token.ts:108 const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly // Later: Allocates without validation const tagBody = await tokenizer.readBuffer(Buffer.alloc(size)); // If actual data 100 ? '⚠️ LARGE ALLOCATION' : '✓ Normal'); ``` Expected output: ``` Input file size: 10 bytes ✓ Parse succeeded (no error thrown) ✓ Metadata returned: { format: {}, common: {}, native: {} } ⚠️ ~268 MB was allocated despite only 10 bytes of input Memory before: { heapUsed: '2.50 MB', external: '0.00 MB' } Memory after: { heapUsed: '2.60 MB', external: '256.00 MB' } externalDelta: 256.00 MB Parse time: 15.23 ms Result: ⚠️ LARGE ALLOCATION ``` --- Impact Vulnerability Type: Uncontrolled Memory Allocation / Denial of Service (CWE-789) Attack Vector: Network - Any service that accepts and parses MP3/FLAC/DSF/Musepack files Who is Impacted: • Music streaming platforms (Spotify, Apple Music, YouTube Music, etc.) • Podcast hosting services (Podbean, Transistor, Anchor, etc.) • Media servers (Plex, Subsonic, Jellyfin, etc.) • Audio processing services (Discord, Slack, Teams) • Any web service with file upload that uses music-metadata Real-World Exploitation: 1. Single Attacker, Multiple Files: • Upload 10 malicious ID3v2 files (10 bytes each) • Force 2.68 GB memory allocation • Overwhelm server memory capacity 2. Distributed Attack: • 100 concurrent uploads × 268 MB = 26.8 GB memory • Exhaust server memory, force OOM kills • Crash worker processes, cause DoS 3. Slow Leak: • Repeatedly upload truncated ID3v2 files • Each parse allocates 268 MB • Memory leaks accumulate over time • Server becomes unresponsive 4. Cost Impact: • Forced to scale up server capacity for parsing • Increased infrastructure costs • Reduced service availability