Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114113Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

High 8.4

In plain English

A high-severity security flaw in sharp from lovell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.1%top 98.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	sharp	0.35.0	GHSA-f88m-g3jw-g9cj

Affected products (as reported)

Vendor	Product	Versions
lovell	sharp	0 – before 0.35.0

Weakness: CWE-1395 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

References

GitHub Security Advisory (GHSA-f88m-g3jw-g9cj) vendor-advisory
VulnCheck Advisory: Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders third-party-advisory