sharp: Remote code execution via bundled libheif AVIF decoding
Summary
The Node.js image library sharp before 0.35.4 bundles a vulnerable libheif version. An attacker who supplies a crafted AVIF or HEIF image to an application that processes untrusted images can trigger decoding flaws that may lead to remote code execution on glibc-based Linux. Exposure depends on whether sharp runs in production and handles user-supplied images.
Affected
- sharp versions below 0.35.4 (npm package sharp)
- Prebuilt binaries bundling libheif before 1.23.2
- Systems using a globally installed libheif older than 1.23.2 are also affected
Fixed in
- Upgrade sharp to 0.35.4 or later, which provides libheif 1.23.2 (per GHSA-rgj7-g3m4-5g8c)
- A third-party source reports 0.35.5 as the current release; this is not verified
- For a globally installed libheif, use version 1.23.2 or later
Workaround
- Block sharp's HEIF/AVIF loader in code, as recommended by the vendor advisory: sharp.block({ operation: ["VipsForeignLoadHeif"] })
- Reject AVIF and HEIF uploads at the edge
- Run Node.js as a Position Independent Executable (PIE); the official Node.js binaries are not built this way
- Process images in a sandboxed or unprivileged container
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in CISA KEV; no known exploitation reported
- No public proof of concept found in the research; this does not prove none exists
Our recommendation
- Find sharp in lockfiles and deployed images (for example with npm ls sharp), including transitive copies
- Check whether sharp runs in production and processes untrusted images
- Upgrade to sharp 0.35.4 or later and rebuild containers or artifacts, because libheif is bundled in the native binary
- If upgrading is not possible, apply the AVIF/HEIF block and restrict uploads to the formats you need
- Monitor NVD and the GitHub advisory for updated scores or a KEV listing; scanners may show a higher score (9.3) from CVSS 3.1
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rgj7-g3m4-5g8c github.com
- VulnCheck advisory: Sharp before 0.35.4 RCE via bundled libheif www.vulncheck.com
- OpenCVE: CVE-2026-114112 app.opencve.io
- GitLab advisory mirror GHSA-rgj7-g3m4-5g8c advisories.gitlab.com
- Strix CVE summary CVE-2026-114112 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:28.
Original description (NVD)
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.