GHSA-rgj7-g3m4-5g8c: Npm/sharp vulnerability
Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions.
The attack vector for these claims to be "network" however sharp does not provide any networking features so this vulnerability is down-rated to a "High" severity using CVSSv4 but please note its Subsequent System Impact.
Those processing untrusted input with versions of sharp prior to 0.35.4 are affected.
Patches
Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest version, currently 0.35.4, which provides libheif 1.23.2.
Using a globally-installed libheif?
Please ensure you are using the latest libheif 1.23.2.
Workarounds Add the following to your code to prevent sharp from decoding AVIF images. js sharp.block({ operation: ["VipsForeignLoadHeif"] });
Ensure you are using a node executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already do this for protection against RCE however be warned that the "official" Node.js binaries do not.
References - CVE-2026-84383 - https://github.com/strukturag/libheif/security/advisories/GHSA-2jg2-4ch7-h545
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sharpto a version that resolves this vulnerability.Fixed in 0.35.4 - Upgrade
Upgrade
sharpto a version that resolves this vulnerability.Fixed in 0.35.4 - Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2 - Configuration
Add the following to your code to prevent sharp from decoding AVIF images: `sharp.block({ operation: ["VipsForeignLoadHeif"] });`
sharp sharp.block({ operation: ["VipsForeignLoadHeif"] }) = true
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments that process untrusted input using sharp versions earlier than 0.35.4 are affected. The described RCE impact applies to glibc-based Linux under certain conditions, and sharp itself does not provide networking features.
What needs to happen for exploitation?
An attacker would need to cause the application to process untrusted image input. The supplied workaround specifically prevents decoding AVIF images, indicating AVIF decoding is the relevant exposure path.
How should installations using sharp's prebuilt binaries be remediated?
Upgrade sharp to version 0.35.4, which provides libheif 1.23.2. Users relying on a globally installed libheif should ensure that libheif is version 1.23.2.
What can be done if an upgrade cannot be applied immediately?
Disable HEIF/AVIF decoding in sharp with sharp.block({ operation: ["VipsForeignLoadHeif"] });. On Linux, ensure the node executable is compiled as a Position Independent Executable (PIE); most Linux package-manager builds already include this protection.