Back to Catalog
Navidrome logo

Navidrome

Open source music collection server and streamer, like your personal Spotify

app

Alternative to: spotify, apple music, youtube music

Website Repository Docs
About Versions (106)
Back to Versions

v0.64.1

2026-09-21

This is a security release. It fixes five vulnerabilities reported through our GitHub Security Advisory program, covering Subsonic authentication, artwork fetching, playlist cover images, player ownership, and per-user library filtering. Upgrade as soon as you can. Thanks to the researchers credited below for reporting them privately.

The release also improves Jellyfin client support, with both Manet and JellyBox tested and validated against live servers. Manet used to abort its entire library sync on a single missing field and show an empty library. It now syncs end to end. JellyBox got stuck on the login screen. It now signs in and plays, confirmed on Android. Navidrome also reports itself as Jellyfin 12.1.0, accepts Quick Connect sign-in, and can announce itself on your local network so clients find it without you typing an address.

Smart playlists can reference another playlist by path, and the web UI now formats dates using the language you picked in Personal settings.

Security

  • Unauthenticated password brute-force through the Subsonic API. Failed Subsonic logins were never throttled, so an attacker could guess passwords at full speed. Navidrome now rate limits failed authentication attempts. High, CVSS 7.4. (GHSA-p994-r776-mw52, #6185) Reported by @osageling.
  • Authenticated SSRF through M3U external album artwork. A playlist could point #EXTALBUMARTURL at a private or loopback address, turning the server into a probe for internal network services. Navidrome now blocks private and loopback addresses in remote image fetches. Medium, CVSS 6.5. (GHSA-8hjf-6h34-82hr, #6181) Reported by @kaardeco.
  • Cross-library file read through the M3U playlist cover. #EXTALBUMARTURL also accepted a local path, so a playlist could serve any file the server can read as its cover image. Only real image files are accepted as local artwork sources now. Medium, CVSS 6.5. (GHSA-vwq6-xrw5-phpg, #6180) Reported by @qrn12580.
  • Player takeover by any authenticated user. Creating a player could overwrite an existing record and reassign its owner, and device registration reused another user’s player without an ownership check. Both paths now check the owner. Medium, CVSS 6.4. (GHSA-37h4-53gj-cw8m, #6184) Reported by @RealFakeAccount and @qrn12580.
  • Library filter skipped on bookmarks, playlist tracks and now-playing. These three endpoints ignored the libraries a user is allowed to see, leaking track metadata from other libraries. The filter now applies to all of them. Medium, CVSS 4.3. (GHSA-pcjv-h48m-833g, #6179) Reported by @sondt99.

Configuration Changes

StatusOptionDescriptionDefault
NewJellyfin.AutoDiscoveryAnswers Jellyfin’s UDP discovery broadcasts, so clients find the server on the local network. (#6169)false
NewJellyfin.QuickConnectAllows Quick Connect sign-in, where a client shows a code you approve from a session that is already signed in. (#6174)true

For a complete list of all configuration options, see the Configuration Options documentation.

Jellyfin API

  • Add Quick Connect sign-in. The client shows a short code, and you approve it from a session that is already signed in, so the client never sees your password. (#6174 by @deluan)
  • Add opt-in LAN auto-discovery, so Jellyfin clients find the server without you typing its address. Docker users need host networking for the UDP broadcast to reach the container. (#6169 by @deluan)
  • Report Jellyfin 12.1.0 and add the 12.x features clients check for, including fillWidth and fillHeight image sizing. (#6163 by @deluan)
  • Match Jellyfin’s item payloads, so clients that decode strictly can finish a sync instead of erroring out. (#6151 by @deluan)
  • Match Jellyfin on login SessionInfo, item types and universal streams. (#6161 by @deluan)

UI

  • Format dates using the language selected in Personal settings, instead of always following the browser locale. (#6160 by @deluan)

Smart Playlists

  • Reference another playlist by its path in a smart playlist rule, instead of by id. (#5187 by @davidvedvick)

Subsonic API

  • Log a warning when a nowPlaying scrobble sends more than one id, which the API does not allow. (6b3938b5b by @deluan)

Server

  • Fix the ExtAuth logout redirect on unauthenticated page loads, and stop the warning spam from untrusted sources. (#6176 by @deluan)
  • Return 404 instead of 500 when a native API resource does not exist. (#6131 by @deluan)

Artwork

  • Report a failure when the Last.fm artist page has no image. Last.fm now answers non-browser clients with a bot challenge page, which Navidrome read as “this artist has no image” and recorded as final, with nothing in the log. It now logs a warning and retries, and the other image agents still get their turn. (#6198 by @deluan)
  • Store artwork files as group-readable (mode 0640) instead of owner-only, so other services on the same host can read the image cache. (#6189 by @kwo)

Scanner

  • Update go-taglib to fix “permission denied” errors on shared hosts. (d00c84716 by @deluan)

Scrobbling

  • Double-encode plus signs in artist and track names sent to Last.fm, so tracks with a + in the name scrobble correctly. (#6158 by @deluan)

Packaging

  • Repair root-owned artwork and plugins folders on upgrade. Installs affected by this could not write their own cache. (#6143 by @deluan)

Translations

New Contributors

Full Changelog: https://github.com/navidrome/navidrome/compare/v0.64.0…v0.64.1

Helping out

This release is only possible thanks to the support of some awesome people!

Want to be one of them? You can sponsor, pay me a Ko-fi, or contribute with code.

Where to go next?

Changelog on GitHub →