Find, fix and prevent vulnerabilities in your code.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input.

Workaround

This vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: ["VipsForeignLoadHeif"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).

Remediation

Upgrade sharp to version 0.35.4 or higher.

References

• GitHub Release
• Maintainer's Advisory

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Use After Free in entity_insert() and the entity map held on XmlState, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its Drop implementation calls xmlFreeNode() while the outer xmlCtxtParseEntity() is still using that 144 byte xmlEntity. An attacker can corrupt process memory by supplying an SVG document whose xi:include pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.

Remediation

Upgrade sharp to version 0.35.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitLab Work Item
• Red Hat Bugzilla Bug
• RustSec Advisory
• PoC in GitHub

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Use After Free via a memory-related vulnerability in the bundled librsvg dependency. An attacker can supply an SVG image that, when decoded through librsvg, triggers the memory corruption and results in arbitrary code execution on glibc-based Linux systems.

Note: This is only exploitable when the node executable is not compiled as a Position Independent Executable (PIE); the official Node.js binaries do not use this hardening feature, making them susceptible.

Remediation

Upgrade sharp to version 0.35.5 or higher.

References

• GitHub Advisory

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the bundled libvips image decoding library, specifically its GIF, TIFF, and VIPS image decoders. An attacker can supply malicious GIF, TIFF, or VIPS image files to an application that uses sharp to process untrusted input, triggering multiple flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591, and CVE-2026-69242) in the underlying libvips dependency. Two of these vulnerabilities are rated High severity under CVSSv4, with impacts including high integrity and availability compromise on the local system.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

• GitHub Advisory

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader (VipsForeignLoadTiff), which can miscount the channels of a tile encoded as JPEG or JPEG2000 within a TIFF image. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a TIFF whose JPEG or JPEG2000 tiles cause the channel count to be misdetermined and the buffer undersized. Exploitation requires the application to decode an untrusted TIFF with JPEG or JPEG2000 tiles through sharp.

Workaround

This vulnerability can be avoided by blocking the TIFF loader through sharp's block() for the VipsForeignLoadTiff operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted TIFF images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

• GitHub Advisory
• GitHub Advisory
• GitHub Commit

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader (VipsForeignLoadVips), which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a VIPS (.vips) image whose dimensions overflow the size calculation. Exploitation requires the application to decode an untrusted VIPS image through sharp.

Workaround

This vulnerability can be avoided by blocking the VIPS loader through sharp's block() for the VipsForeignLoadVips operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted VIPS images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

• GitHub Advisory
• GitHub Advisory
• GitHub Commit