sharp
npm4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting sharppage 1 of 1
- CVE-2022-29256MEDIUMCVSS 6.5EG 6.5fixed in 0.30.52022-05-25
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacke…
- CVE-2026-114111HIGHCVSS 8.9EG 8.9fixed in 0.35.52026-10-21
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted…
- CVE-2026-114112HIGHCVSS 8.9EG 8.9fixed in 0.35.42026-10-21
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications pr…
- CVE-2026-114113HIGHCVSS 8.4EG 8.4fixed in 0.35.02026-10-21
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafte…
Check whether sharp is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for sharp CVEs against the assets you own.
Book a Demo →