sharp (npm)
High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, AVIF and TIFF images. Uses the libvips library.
Advisories
8
Latest version
0.35.5
Released Sep 27, 2026
License
Apache-2.0
OpenSSF Scorecard
6.8 / 10
How to fix
Upgrading to 0.35.5 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install sharp@0.35.5yarn
yarn add sharp@0.35.5pnpm
pnpm add sharp@0.35.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-wq5f-xc86-pv6w sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
High EPSS 0.13% |
< 0.35.5 | 0.35.5 |
| GHSA-wq5f-xc86-pv6w sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
High EPSS 0.13% |
< 0.35.5 | 0.35.5 |
| GHSA-rgj7-g3m4-5g8c sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
High EPSS 0.24% |
< 0.35.4 | 0.35.4 |
| GHSA-rgj7-g3m4-5g8c sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
High EPSS 0.24% |
< 0.35.4 | 0.35.4 |
| GHSA-f88m-g3jw-g9cj sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
High EPSS 0.11% |
< 0.35.0 | 0.35.0 |
| GHSA-f88m-g3jw-g9cj sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
High EPSS 0.11% |
< 0.35.0 | 0.35.0 |
| GHSA-54xq-cgqr-rpm3 sharp vulnerability in libwebp dependency CVE-2023-4863 |
High | < 0.32.6 | 0.32.6 |
| GHSA-gp95-ppv5-3jc5 sharp vulnerable to Command Injection in post-installation over build environment |
Medium EPSS 0.39% |
< 0.30.5 | 0.30.5 |
Source: git+https://github.com/lovell/sharp.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor