Announcing MP4Box.js 1.0.0 with TypeScript support

Blog

MP4Box.js – GPAC’s first venture into JavaScript inspired by the MP4Box tool – makes it easy to parse, segment, and manipulate MP4 files in browsers or Node.js.

Over time it’s become an unavoidable tool for Javascript developers willing to analyze, manipulate or generate media content in the browser or any Javascript runtime.

Since version 0.5.2 (Mar 2022), the library has undergone significant evolution: the codebase was modernized, new capabilities were added, and support for additional MP4 box types and streaming formats was extended. Below Deniz Uğur and I highlight the most important changes (released officially in v0.5.3/v0.5.4 and v0.6.x up through v1.0.0), focusing on new features, interface enhancements, and architectural improvements.

Refactored Codebase and TypeScript Support

A key milestone came in version 0.6.0, which is a complete refactor to modern JavaScript. The library was converted into an ECMAScript Module and rewritten in TypeScript.

In practice this means MP4Box.js now ships as an ES module (with CJS compatibility) and includes TypeScript type definitions out-of-the-box. Developers can import MP4Box.js with modern import syntax and enjoy full typing support. This modernization also brought an updated build toolchain (e.g. bundler and linting) and makes integration into contemporary web apps and Node environments much smoother.

The migration is largely transparent to existing code.

Expanded Compatibility for Box Types and MPEG Conformance Streams

Alongside the architectural rewrite, several updates improved compatibility with new MP4 box types and streaming scenarios:

  • MPEG ISOBMFF Box Support – So much to write here, that led us to be up-to-date with MPEG’s ISOBMFF specification. For example, a fix was added to recognize version 1 of the cslg (composition to decode timeline) box, which is used by certain tools like GStreamer. Previously MP4Box.js ignored this newer box version, but now it can parse it correctly. MP4Box.js 1.0.0 enhances compatibility with files produced by modern encoders.
  • Stream Type Extensions (v0.6.4) – The parsing interface was extended to accept additional stream types. In other words, MP4Box.js now recognizes more container streams when you call its parse methods. This lets developers feed in different kinds of input (e.g. alternative fetch or file streams) without having to patch the library.
  • ArrayBuffer fileStart Parameter (v0.6.4) – MP4Box.js’ extended ArrayBuffer type (MP4BoxBuffer.fromArrayBuffer) was updated to require fileStart property explicitlyThis allows you to append ArrayBuffer segments at a specific offset in the virtual file. In practice, this makes progressive loading more flexible (for example, appending fragments of a large MP4 file in order), and it aligns MP4Box.js’s streaming API more closely with the original MP4Box (CLI) behavior.

Enhanced File Saving and mdat Handling

Versions leading up to 1.0.0 introduced more powerful file output capabilities, particularly around the media data (mdat):

  • Rewriting Entire MP4 (v1.0.0) – A big portion of the effort went into fixing issues around MP4Box.js that was preventing valid rewriting of the file including the mdat box. In earlier versions, saving an MP4 often omitted the large media payload (mdat), resulting in an output with only headers. Now MP4Box.js can generate a complete MP4 file (with both metadata and media data) in one step. This is useful for workflows that manipulate or concatenate full MP4 files on the client side.
  • Breaking Change: discardMdatData Default (v1.0.0) – To manage memory use, version 1.0.0 changed the default behavior so that discardMdatData is now true by default. This means by default MP4Box.js will discard (not store) the raw media data it parses unless you explicitly disable this flag. If your application needs the media bytes for rewriting, you can create the file with createFile(true)before parsing. Be aware of this change if upgrading, as it was not the previous default behavior.

More Comprehensive Testing

MPEG Group has built a File Format Conformance Framework around 2 years ago that made it easier to access conformance files. Our contributor Deniz Uğur took advantage of this and tested MP4Box.js against the conformance files from there.

  • Structural Tests – Our testsuite ensures the parsed box layout is identical to what GPAC can output and what was reviewed and accepted by the MPEG File Format group.
  • Roundtrip Tests – We also make sure we can read a file, write it, and read it again without any discrepancies.

Other Interface Improvements and Fixes

Beyond the headline changes above, MP4Box.js received numerous smaller but impactful tweaks:

  • Bug Fixes and Registry Improvements (v0.6.4) – Various internal fixes were made to the box-type registry and parsing logic. For example, box definitions were cleaned up to separate different internal cases, and validation was tightened. While these are mostly behind-the-scenes, they improve stability when dealing with edge-case MP4 files.
  • Streamlining and Cleanup – In multiple releases (v0.6.2, v0.6.3, etc.) general fixes were applied across the codebase (e.g. dependency fixes, housekeeping, and compliance updates). These don’t add new user-facing features, but they ensure the library is more maintainable and compliant with future standards (for instance, fixing build scripts and updating dependencies).

Overall, since v0.5.2 the MP4Box.js library has matured significantly. It now leverages modern JavaScript practices (ESM + TypeScript), has better support for varied MP4 formats and streaming scenarios, and can fully rewrite MP4 files with their media data. These enhancements make MP4Box.js a more powerful and flexible tool for web developers working with GPAC.Last but not least: many thanks to the community and our contributors. Long live MP4Box.js!

100 Million Downloads: A Milestone for the GPAC Community

Blog

Looking back on 25 years of code, collaboration, and quiet, but massive impact.

Illustration by Lluc Pallejà of squeakycarrot.com

As GPAC approaches 100 million downloads across its ecosystem of tools, we’d like to take a moment to reflect — and thank the people who made it possible: our users, contributors, testers, and long-time supporters.

From the early academic days at Télécom Paris to the growing set of tools used in research, prototyping, packaging, streaming, and browser-based applications, GPAC has always had one core mission: to give developers high-quality, efficient, and modular building blocks for multimedia workflows.

What’s in the 100 Million?

The number includes cumulative downloads across:

  • The core GPAC framework
  • MP4Box, our popular MP4 multiplexer/demultiplexer
  • MP4Box.js, used in browser environments
  • Other associated GPAC tools and libraries available via GitHub, npm, and other repositories

We know download numbers don’t tell the whole story. Open-source software is widely reused, embedded, and adapted — sometimes anonymously. But when a project like GPAC crosses a milestone like this, it’s a signal of sustained interest, real-world use, and global relevance.

🌍 Where GPAC Shows Up

While we don’t always know who our users are, we’ve seen GPAC show up in:

  • Academic research papers, standardization contributions and student projects
  • Streaming architecture experiments
  • Streaming media workflows as used by Netflix with the help of Motion Spell
  • Browser-based applications using MP4Box.js
  • Open-source media toolkits and larger software stacks

We welcome this diversity. It keeps the project grounded, evolving, and truly open.

The upcoming GPAC release will include new features and refinements based on feedback from our contributors and community — especially in areas like:

  • CMAF packaging
  • Pro workflows in DRM and Advertising
  • Enhanced GPAC Filters documentation
  • Browser-based video handling with MP4Box.js

We’ll also continue efforts to make our tools easier to adopt, whether you’re building for experimentation or integrating GPAC into production environments.

Whether you downloaded GPAC once, use it daily, or contributed code, tests, bug reports, or documentation — thank you.

If you’re using GPAC in your work, we’d love to hear about it. You can drop us a note, contribute to the GitHub discussion, or just share a link. Your stories help shape the future of the project.

Here’s to the next 100 million — and to keeping GPAC useful, efficient, and open.

The GPAC team

The Security Landscape of the GPAC Open-Source Project: A Balanced Perspective

Blog, Community

GPAC is an open-source multimedia framework used by many developers and organizations to manipulate, package, and stream multimedia content. Given the popularity of GPAC in media manipulation tasks, it has naturally caught the attention of security researchers and organizations such as the Cybersecurity and Infrastructure Security Agency (CISA). Over time, many bugs were discovered, a few vulnerabilities have been flagged, prompting some concern in the development community. However, these reports, especially the recent CISA GPAC advisories, are either outdated or have been adequately addressed by the GPAC team, rendering the issues largely non-serious today.

Understanding GPAC Vulnerabilities

Like any large software project written in C, dealing with bitstream parsing, and started at a time where security was not a concern, GPAC’s codebase has been exposed to many types of crashes and vulnerabilities when fed with wrong input data. The most recent CISA GPAC advisories on GPAC vulnerabilities, while helpful for raising awareness, highlight problems that are no longer pressing.

For example, certain vulnerabilities that surfaced in 2024, which included concerns around memory safety, buffer overflows, and input validation, have already been patched in newer releases.

While CISA’s advisories motivated the GPAC team to address these issues more quickly, it is crucial to understand that CISA GPAC reports have a delayed effect when disseminated to the public, meaning the issues are often resolved by the time the advisories are released.

Most of the vulnerabilities cited by CISA are also categorized as low to medium severity, meaning they do not pose immediate or significant risks for most users. Moreover, they primarily affect environments where the code is not sandboxed properly or where media files are processed directly from untrusted sources—scenarios that can often be mitigated with basic security best practices. Even so, beside causing a potential crash, the path to exploitation remains unclear, making most of these reports more of simple bugs than actual security vulnerabilities.

In addition GPAC has a security policy in place. We invite security researchers to follow the instructions for a swift analysis and resolution of their concerns.

Why The Recent CISA Issues Are Not Serious

A few key reasons illustrate why the CISA-reported GPAC issues are not a current concern:

  1. Timely Patching by the GPAC Team: GPAC’s developer community is highly active, with frequent updates and patches released. The vulnerabilities that CISA flagged have, in many cases, been swiftly addressed by GPAC developers. For example, buffer overflow issues raised in early 2023 were quickly resolved in subsequent software patches. The project’s maintainers work closely with the security community and enroll to the public fuzzing and analysis infrastructures to ensure that these issues are catched and mitigated before they are reported.
  2. Limited Exploitability: The majority of the flagged vulnerabilities require specific, often unrealistic conditions to be exploited. Many of the issues only become relevant when processing malicious media files in very particular environments. For developers who follow standard practices—such as sandboxing, using trusted input sources, and staying updated with the latest patches—the risk remains minimal.
  3. Open-Source Advantages: Being an open-source project, GPAC benefits from having many eyes on its codebase. Vulnerabilities are discovered faster, and the community of developers often provides fixes before any serious exploitation can occur. Additionally, transparency is a cornerstone of GPAC, allowing users to inspect the changes and patches themselves, contributing to a sense of shared responsibility and trust.

Practical Steps for Developers Using GPAC

While GPAC’s security situation is stable, it’s always wise to follow a few best practices when using open-source software:

  • Regularly Updated: Ensure you’re using the latest version of GPAC. The project is regularly maintained, and updates contain security fixes.
  • Sandbox Media Processing: When processing media files, especially from unknown or untrusted sources, use sandboxing to limit the impact of any potential vulnerabilities.
  • Monitor Vulnerability Feeds: Keep an eye on any new GPAC vulnerabilities of your deplyed version by keeping an eye on vulnerability databases like the National Vulnerability Database (NVD) to stay informed about any emerging issues that might affect you.
  • Harden Your Systems: Apply general hardening practices to your systems and environments that use GPAC, such as enabling ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), and other standard security mechanisms.

Conclusion

The security issues surrounding GPAC, flagged by CISA and other agencies, have been managed with care by the open-source community. Most of the vulnerabilities were low to medium severity, and the project’s maintainers have been proactive in detecting and addressing them using a state-of-the-art security policy.

For developers and organizations using GPAC, following basic security practices—such as updating regularly and using sandboxing—ensures a safe and secure experience. The concerns raised by CISA’s GPAC advisories, while relevant at the time, have become outdated in the current context.

GPAC remains a robust and secure tool for multimedia processing and streaming, with a community that prioritizes both functionality and security.

MABR: “Multicast Adaptive BitRate”

Blog, News

Introduction: Hybrid by Default

GPAC has a long history of seamlessly blending transport channels, such as broadband and broadcast, to reassemble signals without interruption. This innovative approach is more relevant than ever as it resurfaces in the form of a hybrid unicast OTT combined with Adaptive Bitrate (ABR) streaming, aimed at reducing transport costs while maintaining quality.

GPAC’s commitment to mixing traditional broadcast media with modern interactive applications—what we proudly call “UltraMedia”—is at the core of our vision for the future of media. 

GPAC has been architected to embody this strong vision because we believe it is the future of media, supporting the convergence of media experiences across different platforms and formats. It’s exciting to see multicast and hybrid solutions gaining renewed attention as the industry evolves.

The Most Versatile Multicast-ABR Solution

GPAC stands as the only open-source solution that supports both ROUTE and FLUTE protocols, which is why it is highly regarded within industry consortiums. This makes GPAC the ideal platform for evaluating and experimenting with various protocols, offering reproducible results that can inform decisions on the best approaches to adopt.

Our expertise in ROUTE, showcased by our ATSC 3.0 implementation (which earned us a NAB Innovation Award in 2018), and our recent addition of FLUTE support for DVB-MABR (2024), highlight our commitment to staying at the forefront of technology. GPAC also supports DASH, HLS, and other media formats (albeit with some limitations), allowing users to leverage Multicast-ABR as they would any other format—whether for analyzing, dumping, or integrating with other content.

As we continue to push the boundaries of what’s possible, we value the feedback from our community. Your insights are invaluable to our journey; let us know what features or improvements you need as we shape the future of media together.

Practical Applications of Multicast-ABR

Over time, several compelling applications of multicast-ABR have emerged, showcasing the versatility and potential of this technology in different broadcasting scenarios:

  • Rich-Media Delivery via Broadcast Carousels: One of the standout applications is the use of carousels to send rich-media content over a broadcast signal. This method allows broadcasters to deliver interactive and enhanced content, such as multimedia presentations or additional data layers, alongside the main broadcast stream.
  • Layered Media Transmission: Another innovative use case involves sending a base layer on one channel and an improvement layer on another. This technique enables efficient bandwidth usage while still offering the option to enhance the content quality for users who have the capability to receive and process the additional data.
  • Separate Channel Media Distribution: There’s also the possibility of distributing different media components—such as audio, video, and subtitles—across separate channels. This approach can optimize the delivery process, ensuring that each component is transmitted with the appropriate level of quality and bandwidth allocation.

These examples underscore the adaptability of multicast-ABR and GPAC in addressing various media distribution challenges, further solidifying its role in the future of broadcast and streaming technologies.

The Evolution of IP Multicast in Broadcast

Over the last decade, traditional broadcast has found new life through IP multicast. On mobile networks, technologies like LTE and more recently 5G have driven the broadcasting of content, particularly within managed networks—spaces where IP multicast has been a mainstay for years. As consumer habits shift away from linear consumption, the challenge of merging OTT adaptive streaming with the efficiency of multicast has re-emerged, and GPAC is at the forefront of meeting this challenge.

GPAC’s involvement in HbbTV dates back to 2011, with carousel technologies in use for enhanced radio services as early as 2009 through initiatives like the Radio+ project. When ATSC 3.0 proposed ROUTE, GPAC quickly implemented it, earning the 2018 NAB Innovation Award. This achievement was made possible through the collaborative efforts of our academic partner, Telecom Paris, and GPAC’s commercial arm, Motion Spell, as part of the ConvergenceTV consortium.

Fast forward to 2023, and Motion Spell (the commercial entity backing GPAC) has been selected as the DVB MABR (leveraging FLUTE, a protocol related to ROUTE) solution, positioning it as a potential future standard in the industry. This recognition further cements our role as a leader in the development of cutting-edge media delivery technologies.

Innovating with Sustainability: The SMART-CD Initiative

In media technology, sustainability has become increasingly important. At GPAC, we recognize that innovation must go hand in hand with environmental responsibility. That’s why we’re proud to be part of the SMART-CD consortium, which stands for “Sustainable Media Architecture for TV Content Delivery,” an initiative aimed at addressing the environmental and technological challenges associated with TV service distribution. 

This consortium focuses on optimizing video distribution infrastructure, reducing redundancy in content production and delivery, and developing energy-efficient codecs and transport protocols. This initiative is dedicated to exploring how MABR can reduce the environmental footprint of media delivery, all while maintaining the high-quality experiences that consumers expect. One of its key goals is to create metrics to accurately measure and reduce the carbon footprint of video streaming, particularly within cloud-native architectures.

Through SMART-CD, we are conducting rigorous experiments to assess the potential for energy savings and other environmental benefits when deploying MABR technology. This work not only reinforces GPAC’s commitment to cutting-edge media solutions but also highlights our dedication to driving sustainability within the industry.

The consortium is a collaboration between various industry leaders, including Motion Spell, Telecom Paris, Ateme, Viaccess-Orca, Nexedi, Greenweb and others, and is working on building a sustainable video streaming ecosystem. This includes creating a monitoring framework to collect environmental impact data and an orchestration agent to dynamically manage energy efficiency across the entire video delivery chain​.

Conclusion

The journey towards perfecting multicast-ABR and its integration into modern media landscapes is ongoing. At GPAC, we are proud to contribute to this evolving narrative, combining our technical expertise with a forward-thinking approach. As we continue to innovate, we invite you to join us in shaping the future of media.

Introducing GPAC.WASM – the new WebAssembly Interface to try GPAC

Blog, News

Embarking on the multimedia processing journey with GPAC has never been easier or more accessible, thanks to the GPAC Web Assembly (WASM) Platform. This innovative new interface is designed with every user in mind, from coding novices to seasoned command-line veterans. 

By removing the need for installation and offering a straightforward, interactive interface, we’re opening up the world of GPAC to a broader audience than ever before. No matter your experience level, the GPAC WASM Platform provides a welcoming space to experiment with, learn, and leverage GPAC’s comprehensive multimedia capabilities. 

Dive into our ready-to-use commands or craft your own to see what GPAC can do for you, all while bypassing the common hurdles of getting started. Join us in demystifying multimedia processing, making it more approachable and enjoyable for everyone.

What can you do with the new GPAC WASM Platform?

Before we dive into the possibilities unlocked by the GPAC WASM Platform, let’s take a moment to understand the technology it’s built upon: WebAssembly (WASM).

WebAssembly (WASM) enables high-performance execution of code on Web browsers, providing a fast and efficient alternative to JavaScript for Web applications. WebAssembly represents a significant advancement in performance, bridging the gap between native applications and Web browsers. 

The new GPAC WASM platform opens up exciting possibilities for everyone to experience the power of GPAC with just one click. 

Historically, leveraging GPAC’s full suite of multimedia processing tools required a certain level of technical know-how, including installation and command-line navigation. This necessity often posed a daunting barrier for many, from individuals curious about multimedia processing to professionals seeking efficient, browser-based solutions.

The new platform showcases popular use-cases along with their corresponding command-lines, guiding users effortlessly into the world of GPAC.

  • Audiovisual Play:
    • Command: gpac -i https://wasm-cli.staging.motionspell.com/data/video_180.mp4 -i https://wasm-cli.staging.motionspell.com/data/audio.mp4 aout vout
    • Plays an audiovisual file combining video and audio streams from the provided URLs. This demonstrates GPAC’s capability to synchronize and render multimedia content.
  • Inspect Media:
    • Command: gpac -i https://wasm-cli.staging.motionspell.com/data/video_180.mp4 -i https://wasm-cli.staging.motionspell.com/data/audio.mp4 inspect:full
    • Provides a detailed analysis of the media properties for both the video and audio streams. It’s a powerful tool for understanding the technical specifics and encoding parameters of multimedia files.
  • Trick Mode:
    • Command: gpac -i https://wasm-cli.staging.motionspell.com/data/video_180.mp4 @#Video reframer:saps=1 @ -o iframes.mp4
    • Demonstrates the manipulation of a video stream to extract and save only the I-frames to a new file. This is particularly useful for editing, analyzing, or optimizing video content.
  • Extra Content from a .mpd:
    • Command: gpac -i https://wasm-cli.staging.motionspell.com/data/dash/bbb_30fps.mpd dashin:forward=file -o 'dump/$File$':dynext
    • Shows how to process adaptive streaming content (DASH) by downloading segments from a .mpd (Media Presentation Description) file and saving them. It highlights GPAC’s capabilities in handling streaming media and adaptive bitrate streaming.

As GPAC 2.0 brought support for Python and NodeJS, we felt WebAssembly had the potential to become our next binding (even before the C#, Go, or Rust bindings our community has been discussing).

The introduction of GPAC WASM Platform marks a pivotal development made possible by the GPAC Community. It creates new pathways for usage and deployment scenarios that leverage the versatility of the web. 

This evolution of GPAC through WebAssembly harnesses the power of the web to bring multimedia processing to a wider audience, overcoming barriers previously posed by installation requirements and technical complexities. 

Despite the inherent limitations set by the WebAssembly specification, toolchains, and web browser constraints, we are committed to expanding the platform’s capabilities based on user feedback. 

While the WASM Platform offers a convenient and accessible way to explore many of GPAC’s features, it is worth noting that this web-based version represents a curated selection of what GPAC can do. For those who find themselves bumping up against these boundaries and seeking access to GPAC’s full suite of tools and capabilities, we recommend considering a native installation of GPAC. Doing so may provide a more extensive and in-depth multimedia processing experience.

By bridging the gap between ease of access and powerful functionality, we hope to foster a community of users who feel empowered to experiment with and contribute to the evolution of GPAC. Whether through the GPAC WASM Platform or a native installation, there’s a wealth of potential waiting to be discovered for your multimedia projects.

Get started