CVE-2026-107392 is a medium severity denial of service (CVSS 6.2) in music-metadata. A crafted DSF audio file can crash the Node.js process through an unhandled promise rejection that normal try and catch handling misses. It is fixed in 11.15.0, so upgrade to that version or later.
What's affected
The record says versions before 11.15.0 are affected. The GitHub advisory GHSA-8j4c-6x6g-rq3j, published on 18 August 2026 and rated Moderate, lists affected versions up to and including 11.14.0 and a patched version of 11.15.0. The two sources agree. The advisory describes the issue as a residual of an earlier advisory, so a previous fix did not cover every path.
The weaknesses are CWE-248, uncaught exception, and CWE-400, uncontrolled resource consumption. The vector is local, low complexity, no privileges, availability only. The record says the demonstrated impact is availability loss only and that it needs the DSF parsing path, so an application that never opens DSF files is less exposed.
The record also notes a dependency detail: the crash appears with strtok3 version 10.3.5 or later, which throws an error on a negative skip length. Check the version of that transitive package in your tree as well.
How to check if you're exposed
Find the version of the parser and the tokenizer package it uses:
npm ls music-metadata strtok3
If music-metadata is at 11.14.0 or earlier, upgrade. The strtok3 version tells you whether the throwing behaviour from the record is present, but upgrading music-metadata is the fix whatever the answer.
Then check how your app handles files. Does it accept DSF audio, or any audio, from users? Also check whether you set a handler for unhandled rejections. Node.js by default ends the process on one, as the advisory notes.
What to do now
- Upgrade music-metadata to 11.15.0 or later, and prefer 11.16.0 or later to pick up the other fixes in this series.
- Run parsing of untrusted audio in a worker process so a crash does not take down the service.
- Limit accepted file types to those you need, so DSF is rejected if you do not use it.
- Add a process supervisor that restarts a crashed service, and alert on repeated restarts.
- Review any code that calls a promise returning function without waiting for it, since that pattern lets errors escape a try block.
Why it matters
The advisory pins the bug to one line. When the parser met an unknown chunk, it called a function that returns a promise to skip the payload but did not wait for it. If the declared chunk size was smaller than the header, the skip length became negative, and the tokenizer rejected the promise. Because no one was waiting, the rejection was not attached to the parse call, so Node.js treated it as unhandled and ended the process, possibly after the parse call had already appeared to succeed.
This is why careful try and catch around parse calls did not help. The failure arrives on a different path from the one the caller is watching. Forgotten waits are a class of defect that code review catches and tests often miss, because tests rarely feed a negative size.
A second lesson: check a size field against the minimum it can legally be. The record does not mark this CVE as known exploited.
Quick check
Why did my try and catch not stop the crash?
The advisory says the promise rejection was detached from the parse call, so the parse could resolve before the process crashed.
Does it matter if I never parse DSF files?
The record says the issue requires the DSF parsing path.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
