# sharp (npm) vulnerabilities

4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.35.5 (Sep 27, 2026): no advisory affects it
- Newest unaffected release: 0.35.5 (Sep 27, 2026), the latest release
- Weekly downloads: 154.6M
- Dependents: 10.1K
- Releases: 194 since 0.0.1 (Aug 20, 2013)
- Registry: https://www.npmjs.com/package/sharp
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-114113: 0.0.1 to 0.35.0-rc.8 (0.35.0 is outside it)
- CVE-2026-114112: 0.0.1 to 0.35.4-rc.0 (0.35.4 is outside it)
- CVE-2026-114111: 0.0.1 to 0.35.5-rc.1 (0.35.5 is outside it)
- CVE-2022-29256: 0.0.1 to 0.30.4 (0.30.5 is outside it)

## Advisories (4)

### [CVE-2026-114113](https://cve.now/CVE-2026-114113): Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

- Severity: High 8.4
- Published: Oct 21, 2026
- Affected: fixed in 0.35.0.
- Fixed in 0.35.0 (released Jun 10, 2026, 133 days before disclosure).
- The latest release, 0.35.5, is not affected.
- 31% of sharp downloads last week were affected versions (51.7M).

### [CVE-2026-114112](https://cve.now/CVE-2026-114112): Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

- Severity: High 8.9
- Published: Oct 21, 2026
- Affected: fixed in 0.35.4.
- Fixed in 0.35.4 (released Aug 26, 2026, 56 days before disclosure).
- The latest release, 0.35.5, is not affected.
- 37% of sharp downloads last week were affected versions (62.8M).

### [CVE-2026-114111](https://cve.now/CVE-2026-114111): Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability

- Severity: High 8.9
- Published: Oct 21, 2026
- Affected: fixed in 0.35.5.
- Fixed in 0.35.5 (released Sep 27, 2026, 24 days before disclosure).
- The latest release, 0.35.5, is not affected.
- 46% of sharp downloads last week were affected versions (77.6M).

### [CVE-2022-29256](https://cve.now/CVE-2022-29256): Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

- Severity: Medium 6.5
- Published: May 25, 2022
- Affected: fixed in 0.30.5.
- Fixed in 0.30.5 (released May 23, 2022, 2 days before disclosure).
- The latest release, 0.35.5, is not affected.
- 0.2% of sharp downloads last week were affected versions (341.3K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/sharp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.