GHSA-4vjr-crvh-383h

@napi-rs/image affected by libwebp CVE

8.8 HighFix available

GHSA-4vjr-crvh-383h is a high vulnerability (CVSS 8.8) in @napi-rs/image, published September 27, 2023. No source lists public exploit code. Fixed in @napi-rs/image 1.7.0.

What does this mean?

Severity: 8.8 HighCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.7.0@napi-rs/image

Description

Impact

Heap buffer overflow in libwebp allows a remote attacker to perform an out of bounds memory write via a crafted webp image.

References

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Affected packages

Affected packages
Package	Affected	Fixed
`@napi-rs/image` npm	before 1.7.0	1.7.0

What each source reports

GitHub Advisories Score used8.8

@napi-rs/image affected by libwebp CVE

Impact

Heap buffer overflow in libwebp allows a remote attacker to perform an out of bounds memory write via a crafted webp image.

References

Record: GHSA-4vjr-crvh-383h
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV8.8

@napi-rs/image affected by libwebp CVE

Impact

Heap buffer overflow in libwebp allows a remote attacker to perform an out of bounds memory write via a crafted webp image.

References

Record: GHSA-4vjr-crvh-383h
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.