CRITICAL🇵🇱 Wersja polska

CVE-2026-25579

CVSS 9.2v4.0pub. 2026-02-04upd. 2026-02-18

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

🤖 AI Analysis
How it works

The attacker sends an HTTP request to the /rest/getCoverArt or /share/img/<token> endpoint with an extremely large value for the size parameter. The Navidrome server attempts to generate an image of the requested dimensions, causing uncontrolled RAM consumption growth. If the system has sufficient memory and does not trigger the OOM killer mechanism, Navidrome saves huge image files to the cache directory — multiple such requests allow rapid exhaustion of available disk space. Otherwise, the Linux OOM killer mechanism is triggered, which terminates the Navidrome process, causing complete service unavailability.

Impact

An attacker can cause complete shutdown of the Navidrome server (DoS) by exhausting RAM and triggering the OOM killer, and in case of systems with large amounts of RAM — by exhausting disk space by filling the cache directory with enormous image files.

Mitigation & patch

Update Navidrome to version 0.60.0, in which the issue has been fixed. The patch is available in the project's GitHub repository at https://github.com/navidrome/navidrome/releases/tag/v0.60.0

Who is affected

Navidrome in versions prior to 0.60.0. Performing the attack requires having a user account or knowledge of a shared image token.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Navidrome

    APP
    Navidrome
    < 0.60.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-47062CRITICAL9.4PL ✓same product

SQL Injection i ORM Leak w Navidrome — wyciek danych i brute-force haseł

CVE-2024-41259CRITICAL9.1PL ✓same product

Navidrome: użycie słabego algorytmu haszowania w integracji z Gravatar

CVE-2025-48948HIGH7.4same product

Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in ...

CVE-2025-48949HIGH8.9same product

Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 hav...

CVE-2024-56362HIGH7.1same product

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in...