highJul 21, 2026

sharp: Inherited libvips Vulnerabilities in GIF, TIFF, and VIPS Loaders (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591)

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Versions of the sharp Node.js image library before 0.35.0 bundle a vulnerable libvips that can be crashed or exploited by a crafted GIF, TIFF, or VIPS file, putting any app that processes untrusted…

Packagesharp
Ecosystemnpm
Affected< 0.35.0
Fixed in0.35.0

The problem

sharp bundles libvips as a native dependency and inherits all of its vulnerabilities. Four flaws, two rated High under CVSSv4, were found in the libvips loaders for GIF (VipsForeignLoadNsgif), TIFF (VipsForeignLoadTiff), and VIPS (VipsForeignLoadVips).

An attacker who can supply a crafted image file to an application using sharp can trigger the underlying libvips bug. Depending on the specific CVE, impact ranges from process crash (denial of service) to potential memory corruption.

The fix

Upgrade sharp to 0.35.0 or later (currently 0.35.3), which bundles libvips 8.18.3 containing all four fixes. If you use a globally-installed libvips instead of the prebuilt binaries, upgrade it to 8.18.3 separately.

Immediate workaround if you cannot upgrade right now: add the following to your application startup code to block the three vulnerable loaders.

sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] });

Reported by libvips security team.

References: [1][2][3][4][5][6]

Related research