{"items":[{"id":"NVI-00019674","kind":"vulnerability","title":"sharp : Vulnerability in librsvg dependency CVE-2026-96889","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wq5f-xc86-pv6w","CVE-2026-114111"],"plain_summary":"OSV carries this publisher advisory for sharp. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 0.35.5 for sharp. Confirm the publisher’s latest guidance.","source_ids":["sr-95fc3464e14718ebf6183998f36f7c12"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-95fc3464e14718ebf6183998f36f7c12","url":"https://github.com/advisories/GHSA-wq5f-xc86-pv6w","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-wq5f-xc86-pv6w","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-08T01:45:46.889Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-95fc3464e14718ebf6183998f36f7c12"],"technology":"sharp","known_exclusions":[],"conditions_summary":"### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed librsvg?\n\nPlease ensure you are using the latest librsvg 2.63.2.\n\n### Workarounds\n\nAdd the following to your code to prevent sharp from decoding SVG images.\n```js\nsharp.block({ operation: [\"VipsForeignLoadSvg\"] });\n```\n\nTo avoid RCE, ensure you are using a `node` executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the \"official\" Node.js binaries do not.\n1","public_affected_ranges":["SEMVER: introduced 0; fixed 0.35.5"]}],"null_published_at":"2026-11-08T08:10:35.856Z","source_updated_at":"2026-10-21T10:57:27.441Z","source_disclosed_at":"2026-10-06T13:43:57.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-08T01:45:46.889Z"}],"next_cursor":null,"snapshot_revision":"42594"}