- Latest release
- 0.35.5 (Sep 27, 2026): no advisory affects it
- Newest unaffected release
- 0.35.5 (Sep 27, 2026), the latest release
- Advisories
- 4 · 3 high, 1 medium
- Weekly downloads
- 154.6M
- Dependents
- 10.1K
- Releases
- 194 since 0.0.1 (Aug 20, 2013)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-114113Affects 0.0.1 to 0.35.0-rc.8 (0.35.0 is outside it)
- CVE-2026-114112Affects 0.0.1 to 0.35.4-rc.0 (0.35.4 is outside it)
- CVE-2026-114111Affects 0.0.1 to 0.35.5-rc.1 (0.35.5 is outside it)
- CVE-2022-29256Affects 0.0.1 to 0.30.4 (0.30.5 is outside it)
Advisories 4
- CVE-2026-114113High 8.4
Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
Affected: fixed in 0.35.0.
Fixed in 0.35.0 (released Jun 10, 2026, 133 days before disclosure).
The latest release, 0.35.5, is not affected.
31% of sharp downloads last week were affected versions (51.7M).
- CVE-2026-114112High 8.9
Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
Affected: fixed in 0.35.4.
Fixed in 0.35.4 (released Aug 26, 2026, 56 days before disclosure).
The latest release, 0.35.5, is not affected.
37% of sharp downloads last week were affected versions (62.8M).
- CVE-2026-114111High 8.9
Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
Affected: fixed in 0.35.5.
Fixed in 0.35.5 (released Sep 27, 2026, 24 days before disclosure).
The latest release, 0.35.5, is not affected.
46% of sharp downloads last week were affected versions (77.6M).
- CVE-2022-29256Medium 6.5
Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment
Affected: fixed in 0.30.5.
Fixed in 0.30.5 (released May 23, 2022, 2 days before disclosure).
The latest release, 0.35.5, is not affected.
0.2% of sharp downloads last week were affected versions (341.3K).