Live › vulnerability › CVE-2026-114113
Go to dashboardSharp versions before 0.35.0 ship a libvips build with several known flaws in its GIF, TIFF and VIPS decoders. An attacker who gets a crafted image file into an application using sharp to process untrusted input can trigger these flaws.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use sharp to decode user-supplied GIF, TIFF or VIPS images are exposed, such as upload handlers, thumbnailers and image conversion pipelines. Services that only process images you produce yourself or never accept outside files have less exposure.
No product ranges from the sources yet.
npm ls sharp to find the installed sharp version and check whether it is below 0.35.0package.json and lockfiles across all services that process uploaded images0.35.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
This page as .md · .json · in your agent: get_signal("CVE-2026-114113")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.