Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux. Patches Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2. Using a globally-installed librsvg? Please ensure you are using the latest librsvg 2.63.2. Workarounds Add the following to your code to prevent sharp from decoding SVG images. To avoid RCE, ensure you are using a node executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the "official" Node.js binaries do not. 1
Recommended action: Upgrade to 0.35.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions. The attack vector for these claims to be "network" however sharp does not provide any networking features so this vulnerability is down-rated to a "High" severity using CVSSv4 but please note its Subsequent System Impact. Those processing untrusted input with versions of sharp prior to 0.35.4 are affected. Patches Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest version, currently 0.35.4, which provides libheif 1.23.2. Using a globally-installed libheif? Please ensure you are using the latest libheif 1.23.2. Workarounds Add the following to your code to prevent sharp from decoding AVIF images. Ensure you are using a node executable binary…
Recommended action: Upgrade to 0.35.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. Patches Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3. Using a globally-installed libvips? Please ensure you are using the latest libvips 8.18.3. Workarounds Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.
Recommended action: Upgrade to 0.35.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. How to resolve this? Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. Using a globally-installed libvips? Please ensure you are using the latest libwebp 1.3.2. Possible workaround Add the following to your code to prevent sharp from decoding WebP images.
Recommended action: Upgrade to 0.32.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There's a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. However, out of an abundance of caution, I've created this advisory. If an attacker has the ability to set the value of the PKGCONFIGPATH environment variable in a build environment then they might be able to use this to inject an arbitrary command at npm install time. I've used the Common Vulnerability Scoring System (CVSS) calculator to determine the maximum possible impact, which suggests a "medium" score of 5.9, but for most people the real impact will be dealing with the noise from automated security tooling that this advisory will bring. AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:X/IR:X/AR:X/MAV:X/MAC:X/MPR:X/MUI:R/MS:X/MC:X/MI:X/MA:X This problem was fixed…
Recommended action: Upgrade to 0.30.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.