Log in Start free

Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M

CVE-2026-25579Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Critical 9.2

In plain English

A critical-severity uncontrolled resource consumption in navidrome from navidrome. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24navidrome0.60.0-r0ALPINE-CVE-2026-25579
Gogithub.com/navidrome/navidrome0.60.0GHSA-hrr4-3wgr-68x3
Gogithub.com/navidrome/navidrome0.60.0GO-2026-4411

Affected products (as reported)

VendorProductVersions
navidrome navidrome < 0.60.0

Weakness: CWE-400, CWE-770, CWE-789 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References