{"id":"CVE-2026-114111","aliases":["GHSA-wq5f-xc86-pv6w"],"url":"https://o3.security/vulnerability/CVE-2026-114111","summary":"Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability","details":"### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed librsvg?\n\nPlease ensure you are using the latest librsvg 2.63.2.\n\n### Workarounds\n\nAdd the following to your code to prevent sharp from decoding SVG images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadSvg\"] });\n```\n\nTo avoid RCE, ensure you are using a `node` executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the \"official\" Node.js binaries do not.\n1","published":"2026-10-21T00:37:10.362Z","modified":"2026-10-24T02:50:19.776402226Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"sharp","fixedVersion":"0.35.5"}],"fix":{"url":"https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236","label":"lovell/sharp@96de105"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114111.json"},{"type":"ADVISORY","url":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114111"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability"},{"type":"WEB","url":"https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236"},{"type":"PACKAGE","url":"https://github.com/lovell/sharp"},{"type":"WEB","url":"https://github.com/lovell/sharp/releases/tag/v0.35.5"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-96889"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:50:19.776402226Z"}}