music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Affected: npm: music-metadata

### Summary

The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error.

---

### Details

**Vulnerable Code Path:**

- `lib/id3v2/ID3v2Token.ts:108` - Syncsafe size read without validation - `lib/id3v2/ID3v2Parser.ts:122` - Full tag body allocated before reading - `lib/id3v2/AbstractID3Parser.ts:22` - Allocation happens before stream validation

**Root Cause:**

The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking:

1. If the tag size exceeds the remaining file size 2. If the tag size exceeds a reasonable maximum 3. If the subsequent read will actually succeed

```typescript // ID3v2Token.ts:108 const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly

// Later: Allocates without validation const tagBody = await tokenizer.readBuffer(Buffer.alloc(size)); // If actual data < size, read fails but allocation succeeded ```

**Attack Mechanism:**

1. File contains valid ID3v2 header with 10 bytes total 2. ID3v2 size field claims 268,435,455 bytes (maximum syncsafe value) 3. Parser all…