CVE-2026-114113

About vulnerability

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Affected product:

Next.js , React , Vue , arcjet-js , astro , astro-expressive-code , astrojs-cloudflare , astrojs-markdoc , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-svelte , astrojs-tailwind , astrojs-vercel , astrojs-vue , babel-plugin-remove-graphql-queries , builder.io-qwik-city , clerk-astro , docusaurus , elements , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-manifest , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-sharp , gatsby-source-contentful , gatsby-source-filesystem , gatsby-source-wordpress , gatsby-transformer-sqip , huggingface-transformers , imagetools , img-sharp-darwin-arm64 , img-sharp-darwin-x64 , img-sharp-linux-arm , img-sharp-linux-arm64 , img-sharp-linux-ppc64 , img-sharp-linux-riscv64 , img-sharp-linux-s390x , img-sharp-linux-x64 , img-sharp-win32-arm64 , img-sharp-win32-ia32 , img-sharp-win32-x64 , ipx , lancedb , livekit-agents-plugin-livekit , livestore-utils-dev , lucide-astro , mastra , mastra-lance , miniflare , modern-js-image , netlify-dev , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , npm:gatsby-theme-blog-core , panda , qwik , remotion-video-matting , remotion-whisper-webgpu , responsive-loader , rsbuild-image , scalar-astro , scalar-starlight , sentry-gatsby , sharp , storybook-experimental-nextjs-vite , storybook-nextjs , theme-ui , workers-sdk , zephyr-astro-integration

Affected packages:

sharp @ 0.32.6 (+1048 more)