CVE-2026-25579
Reported by github_m · Published February 4, 2026
github.com/navidrome/navidrome is fixed in 0.60.0 (Go Modules)
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/navidrome/navidrome | Go Modules | 0.60.0 |
| navidrome | Alpine | 0.60.0-r0 |
| navidrome | navidrome | 0.60.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| navidrome | navidrome | < 0.60.0 |
| github.com | navidrome/navidrome | 0 |
| alpine | navidrome | 0 |
| navidrome | navidrome | 0 |
Timeline
- Feb 4, 2026 CVE Published
- Feb 5, 2026 EPSS Score (30 in total, the first dated here)
- Feb 5, 2026 CVE Updated
- Feb 7, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-25579
vulnetix vdb fixes CVE-2026-25579Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-25579/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3 x_refsource_CONFIRM
- https://github.com/navidrome/navidrome/releases/tag/v0.60.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-25579 advisory
- https://github.com/advisories/GHSA-hrr4-3wgr-68x3 advisory
- https://github.com/navidrome/navidrome url