DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-F88M-G3JW-G9CJ: GHSA-F88M-G3JW-G9CJ: Multiple Memory Safety and Integer Overflow Vulnerabilities in libvips affecting sharp

#security #cve #cybersecurity #ghsa

GHSA-F88M-G3JW-G9CJ: Multiple Memory Safety and Integer Overflow Vulnerabilities in libvips affecting sharp

Vulnerability ID: GHSA-F88M-G3JW-G9CJ
CVSS Score: 8.5
Published: 2026-07-21

The high-performance Node.js image processing library sharp inherits several high and medium-severity security vulnerabilities from its underlying native dependency libvips. These include integer overflows in dimensions calculation, heap-based buffer overflows in GIF/TIFF and JPEG2000 processing, and out-of-bounds reads in the EXIF directory decoder, enabling denial of service and potential code execution.

TL;DR

Vulnerabilities in native library libvips permit denial of service and heap-based buffer overflows when parsing malformed image files via Node.js applications utilizing sharp.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-190, CWE-122, CWE-125
  • Attack Vector: Local/Remote upload of crafted image files
  • CVSS Score: 8.5
  • Impact: Denial of Service, Out-of-bounds Read, and potential Remote Code Execution
  • Exploit Status: PoC / Technical Analysis Stage
  • KEV Status: Not Listed

Affected Systems

  • Applications utilizing the sharp library on Node.js running on Windows, macOS, or Linux where underlying libvips version is below 8.18.2
  • libvips: <= 8.18.1 (Fixed in: 8.18.2)
  • sharp: All versions linking dynamically or statically to libvips < 8.18.2 (Fixed in: sharp releases containing libvips >= 8.18.2)

Code Analysis

Commit: 61e71c1

iofuncs: add vips_image_sanity dimension checked multiplication checks

Commit: 9b633e4

nsgifload: fix possible integer overflow on 32-bit dimensions

Commit: 91ebd4d

exif: add range verification for EXIF IFD tag group index

Commit: df044e4

tiff2vips: match bytes_per_pixel with components in decompressed tile

Mitigation Strategies

  • Upgrade npm package sharp to the latest version bundling libvips 8.18.2 or greater
  • Implement gateway-level dimension and payload file size limiting
  • Recompile system libvips without optional TIFF and JPEG2000 loaders if unused

Remediation Steps:

  1. Check current dependency trees using 'npm list sharp'
  2. Run 'npm install sharp@latest' to fetch the latest prebuilt binaries with the fix
  3. Add validation middleware checking image dimensions via fast metadata header parsers before sending to full decoding pipelines

References

Read the full report for GHSA-F88M-G3JW-G9CJ on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)