Loop with Unreachable Exit Condition ('Infinite Loop') Affecting openclaw package, versions <2026.3.12-r0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-OPENCLAW-15704823
- published20 Mar 2026
- disclosed18 Mar 2026
Introduced: 18 Mar 2026
NewCVE-2026-32256 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade Minimos:latest openclaw to version 2026.3.12-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openclaw package and not the openclaw package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (parseExtensionObject() in lib/asf/AsfParser.ts:112-158) enters an infinite loop when a sub-object inside the ASF Header Extension Object has objectSize = 0. Version 11.12.3 fixes the issue.
References
- https://www.cve.org/CVERecord?id=CVE-2026-32256
- https://github.com/advisories/GHSA-v6c2-xwv6-8xf7
- https://osv.dev/vulnerability/MINI-4pmg-2rrh-997j
- https://osv.dev/vulnerability/CVE-2026-32256
- https://github.com/Borewit/music-metadata/releases/tag/v11.12.3
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-v6c2-xwv6-8xf7