npm/sharp CVE-2026-114113: high 8.4

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Action: Upgrade sharp to 0.35.0 or later.

npm i sharp@0.35.0

Affected

Fixed versions

Sources

• osv: GHSA-f88m-g3jw-g9cj
• nvd: CVE-2026-114113
• https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x
• https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76
• https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm
• https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
• https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj
• https://github.com/lovell/sharp

CVE-2026-114113 · published 2026-07-21T22:07:17Z · modified 2026-10-21T10:57:27.250198301Z · JSON