Skip to content
OpenAdvisories

Package · npm

sharp

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.4
    CVE-2026-114113

    Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

    Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS …

    lovell sharp sharp npm
  • High 8.9
    CVE-2026-114112

    Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

    Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted i…

    lovell sharp sharp npm
  • High 8.9
    CVE-2026-114111

    Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability

    sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, whe…

    lovell sharp sharp npm
  • High 7.8
    GHSA-54xq-cgqr-rpm3

    sharp vulnerability in libwebp dependency CVE-2023-4863

    ## Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. ## Who does this affect? Almost anyone processing untrusted input with versions…

    sharp npm