{"id":"GHSA-54xq-cgqr-rpm3","aliases":["CLSA-2026-1790458446","ROOT-APP-NPM-GHSA-54xq-cgqr-rpm3"],"status":"published","title":"sharp vulnerability in libwebp dependency CVE-2023-4863","description":"## Overview\n\nsharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.\n\n## Who does this affect?\n\nAlmost anyone processing untrusted input with versions of sharp prior to 0.32.6.\n\n## How to resolve this?\n\n### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.\n\n### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libwebp 1.3.2.\n\n## Possible workaround\n\nAdd the following to your code to prevent sharp from decoding WebP images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadWebp\"] });\n```","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-11-16T17:14:15Z","modified":"2026-10-15T09:47:57Z","fixes":[{"ecosystem":"npm","package":"sharp","fixed_in":["0.32.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"sharp","fixed_in":["0.27.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"sharp","fixed_in":["0.30.7-aikido.2","0.30.7-aikido.3","0.30.7-aikido.1","0.32.6-aikido.2","0.32.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/sharp","fixed_in":["0.30.7-root.io.2","0.30.7-root.io.3","0.30.7-root.io.1","0.32.6-root.io.2","0.32.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.2"}]}],"versions":["0.27.2","0.27.2-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"sharp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.32.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.7-aikido.2"},{"fixed":"0.30.7-aikido.3"},{"fixed":"0.30.7-aikido.1"},{"fixed":"0.32.6-aikido.2"},{"fixed":"0.32.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.7-root.io.2"},{"fixed":"0.30.7-root.io.3"},{"fixed":"0.30.7-root.io.1"},{"fixed":"0.32.6-root.io.2"},{"fixed":"0.32.6-root.io.1"}]}]}],"references":[{"url":"https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3","tags":["web"]},{"url":"https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-54xq-cgqr-rpm3"},{"url":"https://github.com/lovell/sharp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-54xq-cgqr-rpm3","title":"sharp vulnerability in libwebp dependency CVE-2023-4863","description":"## Overview\n\nsharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.\n\n## Who does this affect?\n\nAlmost anyone processing untrusted input with versions of sharp prior to 0.32.6.\n\n## How to resolve this?\n\n### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.\n\n### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libwebp 1.3.2.\n\n## Possible workaround\n\nAdd the following to your code to prevent sharp from decoding WebP images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadWebp\"] });\n```","status":"published","published":"2023-11-16T17:14:15Z","modified":"2023-11-16T17:14:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:22.040291Z"}],"osv":[{"id":"GHSA-54xq-cgqr-rpm3","title":"sharp vulnerability in libwebp dependency CVE-2023-4863","description":"## Overview\n\nsharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.\n\n## Who does this affect?\n\nAlmost anyone processing untrusted input with versions of sharp prior to 0.32.6.\n\n## How to resolve this?\n\n### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.\n\n### Using a globally-installed libvips?\n\nPlease ensure you are using the latest libwebp 1.3.2.\n\n## Possible workaround\n\nAdd the following to your code to prevent sharp from decoding WebP images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadWebp\"] });\n```","status":"published","published":"2023-11-16T17:14:15Z","modified":"2023-11-16T17:14:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"CLSA-2026-1790458446","title":"TuxCare security update for sharp (1 CVE)","description":"TuxCare rebuilt sharp to address 1 CVE. Fixed in 0.27.2-tuxcare.2.","status":"published","published":"2026-09-26T21:34:06Z","modified":"2026-10-15T09:47:57.158795727Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-NPM-GHSA-54xq-cgqr-rpm3","title":"GHSA-54xq-cgqr-rpm3 in sharp - Patched by Root","description":"Root has patched GHSA-54xq-cgqr-rpm3 in the sharp package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-22T12:51:45Z","modified":"2026-09-22T13:15:03.143320385Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}