NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

CVE-2026-84987 — sharp

MEDIUMFix: code16/sharp#748

CVE-2026-84987 is a medium-severity (CVSS 5.4) vulnerability in code16/sharp. A fix is available for code16/sharp — see the affected versions and patch details below.

code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 12, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐘code16/sharp🐘code16/sharp

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.

Patches

The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.

Workarounds

Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcode16/sharpall versions9.23.0composer require code16/sharp:^9.23.0
🐘Packagistcode16/sharp≥ 10.0.0-beta.1&&< 10.0.0-beta.410.0.0-beta.4composer require code16/sharp:^10.0.0-beta.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for code16/sharp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update code16/sharp to 9.23.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-84987 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection. ### Workarounds Use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.
O3 Security · Impact-Aware SCA

Is CVE-2026-84987 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-84987: sharp — Fixed in 9.23.0