Borewit vulnerabilities
We track 4 vulnerabilities in Borewit products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Borewit vulnerabilities
- 7.5 High severity
music-metadata: Uncaught Exception
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-b
- 7.5 High severity
music-metadata: Uncontrolled Resource Consumption
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero
- 7.5 High severity
music-metadata: Memory Allocation with Excessive Size Value
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToke
- 7.5 High severity
music-metadata: Loop with Unreachable Exit Condition
music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Ob