{"id":"CVE-2026-114113","kind":"vulnerability","aliases":["CVE-2026-114113"],"related":[],"title":"Sharp: bundled libvips flaws let crafted GIF, TIFF or VIPS files attack","description":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","summary":"Sharp versions before 0.35.0 ship a libvips build with several known flaws in its GIF, TIFF and VIPS decoders. An attacker who gets a crafted image file into an application using sharp to process untrusted input can trigger these flaws.","severity":"high","cvss":8.4,"epss":0.00107,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","node.js","package","sharp"],"not_affected_if":["no-untrusted-images"],"how_to_check":"- Run `npm ls sharp` to find the installed sharp version and check whether it is below `0.35.0`\n- Check for sharp in `package.json` and lockfiles across all services that process uploaded images","fix":"- Upgrade sharp to `0.35.0` or later\n- Reinstall dependencies after upgrading so the bundled libvips is replaced","status":"open","published_at":"2026-10-21T01:17:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:01:45+00:00","updated_at":"2026-10-25T03:01:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:01:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade sharp to `0.35.0` or later\n- Reinstall dependencies after upgrading so the bundled libvips is replaced","reach":"internet","title":"Sharp: bundled libvips flaws let crafted GIF, TIFF or VIPS files attack","impact":"high","summary":"Sharp versions before 0.35.0 ship a libvips build with several known flaws in its GIF, TIFF and VIPS decoders. An attacker who gets a crafted image file into an application using sharp to process untrusted input can trigger these flaws.","category":"package","nicknames":[],"who_cares":["node.js","sharp","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown; sources do not state the memory corruption or code execution outcome","analyst_note":"Sources do not describe the specific impact of each libvips CVE; check the upstream libvips and sharp advisories for exploit details and whether the flaws allow code execution.","how_to_check":"- Run `npm ls sharp` to find the installed sharp version and check whether it is below `0.35.0`\n- Check for sharp in `package.json` and lockfiles across all services that process uploaded images","needs_analyst":true,"not_affected_if":["no-untrusted-images"],"who_is_affected":"Applications that use sharp to decode user-supplied GIF, TIFF or VIPS images are exposed, such as upload handlers, thumbnailers and image conversion pipelines. Services that only process images you produce yourself or never accept outside files have less exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3421,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114113':15A,18A '-2026':14A,17A,78C,81C,84C,87C,91C '-33327':79C '-33328':82C '-35590':85C '-35591':88C '-69242':92C '0.35.0':28B,67C 'affect':73C 'applic':54B,111C 'attack':12A,45B,101C 'build':32B 'bundl':2A,68C 'craft':6A,49B,104C 'cve':13A,16A,77C,80C,83C,86C,90C 'decod':43B,100C 'file':11A,51B,109C 'flaw':4A,36B,64B,121C 'get':47B 'gif':7A,39B,95C,105C 'imag':20B,50B,99C 'image-process':19B 'input':60B,117C 'known':35B 'let':5A 'libvip':3A,31B,72C,120C 'multipl':75C 'node.js':22B 'packag':23B 'process':21B,58B,115C 'sever':34B 'sharp':1A,24B,25B,56B,65C,113C 'ship':29B 'suppli':103C 'tiff':8A,40B,96C,106C 'trigger':62B,118C 'untrust':59B,116C 'use':55B,112C 'version':26B,70C 'vip':10A,42B,98C,108C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Applications that use sharp to decode user-supplied GIF, TIFF or VIPS images are exposed, such as upload handlers, thumbnailers and image conversion pipelines. Services that only process images you produce yourself or never accept outside files have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114113","severity":null,"published_at":"2026-10-21T01:17:37+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114113","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114113","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}