LoginSign Up
← Back to all sparks
N

Navidrome

COLLAB
Velocity2.5

Self-hosted music server and streamer compatible with Subsonic clients

www.navidrome.org ↗

Navidrome patches five vulnerabilities and gets Jellyfin clients working end to end.

music-streamingself-hostedsecurityjellyfin-compatibilitysubsonic
◆Current state
Navidrome's only tracked release, v0.64.1, fixes five reported vulnerabilities: unthrottled Subsonic logins, SSRF and local file reads through M3U artwork, player takeover between users, and library filters skipped on three endpoints. It also makes the Manet and JellyBox Jellyfin clients sync and sign in correctly, adds Quick Connect sign-in and LAN discovery, and lets smart playlists reference other playlists.
◆Where it's heading
Navidrome is broadening beyond its Subsonic API roots by impersonating a Jellyfin server well enough for real Jellyfin apps to work against it. The security release shows multi-user and multi-library deployments are getting tighter permission checks as that surface grows.
◆Prediction
Expect more Jellyfin client validation and compatibility fixes. With only one entry tracked, the larger roadmap isn't visible.

◆Recent moves

  1. 24d ago

    v0.64.1 - Security Fixes

    v0.64.1 closes five vulnerabilities, the most serious being unthrottled password guessing through the Subsonic API, and makes two Jellyfin clients work end to end with Quick Connect and LAN discovery. It shows Navidrome's Jellyfin compatibility moving from partial to tested against real apps.

    View source ↗