sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. Patches Using prebuilt binaries provided by sharp? Most people re...

Integer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader VipsForeignLoadVips, whi...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' through the Gif decoder. An attacker can cause the application to consume excessive memory resources by processing specially crafted image files. Workaround This vulnerability can ...

Out-of-Bounds Write

Overview Affected versions of this package are vulnerable to Out-of-Bounds Write in the ImageSharp gif decoder. An attacker can cause a crash by sending a specially crafted gif file. Remediation Upgrade SixLabors.ImageSharp to version 2.1.9, 3.1.5 or higher. References - GitHub Commit - GitHub...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free due to the InitializeImage function in the PngDecoderCore.cs file. An attacker can potentially lead to information disclosure by passing a specially crafted PNG image file for conversion. Remediation Upgrade...