A vulnerability in the Borewit music-metadata library allows unauthenticated attackers to cause a denial-of-service condition via an infinite loop.

The flaw exists in the parseExtensionObject() function within lib/asf/AsfParser.ts. An unauthenticated attacker can trigger an infinite loop by providing a specially crafted audio or video file containing an ASF Header Extension Object with an objectSize of zero, leading to resource exhaustion.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to the ease of exploitation. Successful exploitation results in a denial-of-service condition, which can cause significant application downtime and instability for systems that process untrusted media files, potentially impacting availability for critical business operations.

Immediate Action: Update the music-metadata package to version 11.12.3 or later via your package manager.

Proactive Monitoring: Monitor server CPU utilization and thread counts for anomalous spikes when processing user-uploaded media files.

Compensating Controls: Implement strict input validation or file size limits at the application entry point to reject malformed media files before they reach the parser.

Public Exploit Available: No

This vulnerability presents a clear denial-of-service risk for any application utilizing the music-metadata library. Given the availability of a patch, organizations should prioritize updating to version 11.12.3 immediately to prevent potential service disruptions.