CVE-2026-114113: Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sharpto a version that resolves this vulnerability.Fixed in 0.35.0
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using npm/sharp versions before 0.35.0 are exposed if they process untrusted GIF, TIFF, or VIPS image files.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply a crafted GIF, TIFF, or VIPS file that the application passes to sharp for processing.
Is processing other image formats affected by the described issue?
The reported affected decoders are GIF, TIFF, and VIPS. The provided information does not identify other image formats as affected.
What upgrade addresses the bundled dependency exposure?
Upgrade sharp to version 0.35.0 or later. Versions before 0.35.0 bundle an affected libvips version.