Package Instance

sharp vulnerability in libwebp dependency CVE-2023-4863
## Overview

sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.

## Who does this affect?

Almost anyone processing untrusted input with versions of sharp prior to 0.32.6.

## How to resolve this?

### Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.

### Using a globally-installed libvips?

Please ensure you are using the latest libwebp 1.3.2.

## Possible workaround

Add the following to your code to prevent sharp from decoding WebP images.
```js
sharp.block({ operation: ["VipsForeignLoadWebp"] });
```