CVE-2026-114113: Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-27
Weakness: CWE-1395

Description

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Affected products

lovell sharp: before 0.35.0 — fixed in 0.35.0

How to fix

Upgrade to a fixed version: lovell sharp 0.35.0. Check the vendor advisory for mitigations.

References

https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj
https://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders

Get alerted when CVE-2026-114113 or the next vulnerability affects your stack