sharp Node.js library: Multiple libvips flaws via GIF, TIFF and VIPS decoders

Summary

The sharp Node.js image library before 0.35.0 bundles a vulnerable version of libvips. Five libvips flaws in its GIF, TIFF and VIPS decoders can be triggered by crafted image files. An attacker who can get such a file processed by a sharp-based application may be able to crash it or corrupt memory, and possibly bypass security controls.

Affected

• sharp versions below 0.35.0 (npm package sharp)
• Applications that use sharp to process untrusted GIF, TIFF or VIPS files
• Applications that bundle sharp, including desktop and developer tools

Fixed in

• sharp 0.35.0 or later (vendor advisory points to 0.35.3, which ships libvips 8.18.3; check the current release)
• If a globally installed libvips is used: libvips 8.18.3 or later

Workaround

• Block the affected decoders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }); GIF, TIFF and VIPS images will then no longer be processed
• The workaround is temporary; patching is the real fix

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total
• Not listed in CISA KEV; no known exploitation in the wild found
• No public exploit identified in the sources reviewed; reports describe impact from denial of service to possible memory corruption
• Severity differs by source: CVSS 4.0 8.4 in the CVE record, CVSS 3.1 7.3 in the GitHub advisory

Our recommendation

• Inventory all sharp instances, including transitive npm dependencies and bundled applications
• Upgrade to the current sharp release and check the release notes for breaking API changes, then run regression tests
• Where the upgrade must wait, apply the decoder block for internet-facing upload paths
• Restrict who can submit files to processing services and monitor them for crashes
• Verify which five libvips CVEs are covered, as the vendor advisory title lists only four

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-f88m-g3jw-g9cj github.com
• VulnCheck advisory www.vulncheck.com
• OSV CVE-2026-114113 osv.dev
• VulDB 423963 vuldb.com
• CVE Reports GHSA-F88M-G3JW-G9CJ cvereports.com
• GitLab Advisory Database sharp GHSA-f88m-g3jw-g9cj advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:12.