Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Overview

CVE-2026-25579 is a denial-of-service vulnerability in Navidrome, an open-source music collection server and streamer. The /rest/getCoverArt and /share/img/ endpoints accept a size parameter that specifies the requested image dimensions. Prior to version 0.60.0, the server performs no upper-bound validation on this parameter. When a very large integer is supplied, the image resizing routine attempts to allocate enough memory to generate an image of that size, leading to uncontrolled memory growth [1][3].

Exploitation

The attack requires an authenticated user account for the /rest/getCoverArt endpoint, or possession of a valid sharing token for the /share/img/ URL [3]. By simply modifying the size parameter in a normal request—replacing a typical value like 300 with an extremely large number such as 300000—the attacker triggers the excessive allocation [3]. No special privileges or network position are needed beyond those credentials.

Impact

On systems running Navidrome, the rapid memory consumption causes the Linux kernel's Out-Of-Memory (OOM) killer to terminate the Navidrome process, resulting in a full service outage [1][3]. If the server has enough RAM to survive the allocation, the oversized image is saved to Navidrome's cache directory, which can quickly fill the disk to capacity. This dual impact—memory exhaustion leading to process termination and disk space exhaustion—makes the vulnerability effective for both immediate and longer-term disruption.

Mitigation

The issue has been patched in Navidrome version 0.60.0 [1][2]. Users should upgrade to this release immediately. No workaround is available for unpatched versions, as the vulnerable endpoints are integral to the application's functionality. The fix likely enforces a maximum allowable size value before passing the parameter to the image processing library.