VulnerableCode Package Details - pkg:npm/sharp@0.30.5

Search for packages

Vulnerability	Summary	Fixed by
VCID-n45w-tfmt-z3cj Aliases: GHSA-54xq-cgqr-rpm3 GMS-2023-4343	sharp vulnerability in libwebp dependency CVE-2023-4863 ## Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. ## Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. ## How to resolve this? ### Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. ### Using a globally-installed libvips? Please ensure you are using the latest libwebp 1.3.2. ## Possible workaround Add the following to your code to prevent sharp from decoding WebP images. ```js sharp.block({ operation: ["VipsForeignLoadWebp"] }); ```	0.32.6 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-n45w-tfmt-z3cj
Aliases:
GHSA-54xq-cgqr-rpm3
GMS-2023-4343

sharp vulnerability in libwebp dependency CVE-2023-4863 ## Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. ## Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. ## How to resolve this? ### Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. ### Using a globally-installed libvips? Please ensure you are using the latest libwebp 1.3.2. ## Possible workaround Add the following to your code to prevent sharp from decoding WebP images. ```js sharp.block({ operation: ["VipsForeignLoadWebp"] }); ```

0.32.6
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-t53w-xfpy-7ugy	sharp vulnerable to Command Injection in post-installation over build environment	CVE-2022-29256 GHSA-gp95-ppv5-3jc5

Vulnerability

Summary

Aliases

VCID-t53w-xfpy-7ugy

sharp vulnerable to Command Injection in post-installation over build environment

CVE-2022-29256
GHSA-gp95-ppv5-3jc5

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T19:11:24.384061+00:00	GitLab Importer	Affected by	VCID-n45w-tfmt-z3cj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/sharp/GMS-2023-4343.yml	38.6.0
2026-06-12T18:24:45.015510+00:00	GitLab Importer	Fixing	VCID-t53w-xfpy-7ugy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/sharp/CVE-2022-29256.yml	38.6.0
2026-06-12T08:18:07.463973+00:00	GithubOSV Importer	Fixing	VCID-t53w-xfpy-7ugy	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-gp95-ppv5-3jc5/GHSA-gp95-ppv5-3jc5.json	38.6.0
2026-06-11T20:31:30.067047+00:00	GHSA Importer	Fixing	VCID-t53w-xfpy-7ugy	https://github.com/advisories/GHSA-gp95-ppv5-3jc5	38.6.0