Heap-based Buffer Overflow Affecting sharp package, versions <0.35.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SHARP-19653587
- published9 Sept 2026
- disclosed8 Sept 2026
- creditUnknown
Introduced: 8 Sep 2026
New CVE NOT AVAILABLE CWE-122 (opens in a new tab)How to fix?
Upgrade sharp to version 0.35.4 or higher.
Overview
sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input.
Workaround
This vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: ["VipsForeignLoadHeif"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).