CLEANSTART-2026-CH28428 Security fixes in langfuse 3.224.1-r1

Package langfuse version 3.224.1-r1 fixes 5 vulnerabilities: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591, ghsa-f88m-g3jw-g9cj...

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. Patches Using prebuilt binaries provided by sharp? Most people re...

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

NPM: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 discovered by ? in WordPress Npm sharp versions 0.35.0...

org.webjars.npm:image-thumbnail (1.0.15), org.webjars.npm:tabler__icons-webfont (3.35.0) potentially affected by CVE-2026-33327 via org.webjars.npm:sharp (>=0.30.4, <=0.33.5)

org.webjars.npm:sharp MAVEN version =0.30.4, =0.33.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sharp and may be impacted: - org.webjars.npm:image-thumbnail 1.0.15 - org.webjars.npm:tablericons-webfont 3.35.0 Source cves:...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0x1 (>=0.0.0, <=0.0.379) +22317 more potentially affected by CVE-2026-33327 via sharp (>=0.4.2, <=0.34.5)

sharp NPM version =0.4.2, =0.1.0, =0.0.0, =0.0.1, =0.0.2, =4.2.0-next.2, =0.0.1, =1.0.0-alpha.1, =1.0.0, =1.0.9, =1.0.0, =0.0.1, =1.225.0, =0.4.0, =0.38.37 and more Source cves: CVE-2026-33327 Source advisory: SNYK:JS-SHARP-18184259...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0x1 (>=0.0.0, <=0.0.379) +22317 more potentially affected by CVE-2026-33327 +1 more via sharp (>=0.4.2, <=0.34.5)

sharp NPM version =0.4.2, =0.1.0, =0.0.0, =0.0.1, =0.0.2, =4.2.0-next.2, =0.0.1, =1.0.0-alpha.1, =1.0.0, =1.0.9, =1.0.0, =0.0.1, =1.225.0, =0.4.0, =0.38.37 and more Source cves: CVE-2026-33327, CVE-2026-35591 Source advisory: GHSA-F88M-G3JW-G9CJ...

CVE-2026-33327

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...