CVE-2026-25579criticalCWE-400CWE-770CWE-789

CVE-2026-25579: critical vulnerability in navidrome

Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Published · Updated

Follow this CVE+ Monitor navidrome+ Monitor github.com/navidrome/navidrome

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.5%
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Affected products
navidrome · navidrome
Related CVEs — navidrome

In the same product, most dangerous first.

CVE-2024-47062CRITICALMultiple SQL Injections and ORM Leak in navidromeEPSS 4.5%CVE-2025-27112MEDIUMNavidrome has authentication bypass in Subsonic API with non-existent usernameEPSS 1.0%CVE-2023-51442HIGHAuthentication bypass vulnerability in navidrome's subsonic endpointEPSS 0.7%CVE-2025-48948HIGHNavidrome Transcoding Permission Bypass Vulnerability ReportEPSS 0.5%CVE-2025-48949HIGHNavidrome allows SQL Injection via role parameterEPSS 0.5%CVE-2024-32963MEDIUMParameter Tampering vulnerability in NavidromeEPSS 0.4%