Several vulnerabilities in the libvips image processing library, two of which are rated high severity under CVSS version 4.0, affect the sharp library when processing untrusted input. These vulnerabilities are fixed in libvips 8.18.3. Sharp versions prior to 0.35.0 that include older libvips versions are vulnerable. The sharp maintainers recommend upgrading to version 0.35.3, which bundles libvips 8.18.3. Alternatively, users with a separate libvips installation should update libvips to 8.18.3. A temporary mitigation is to block sharp from decoding certain image formats (GIF, TIFF, VIPS) known to be affected by these vulnerabilities.

Systems using sharp versions before 0.35.0 that process untrusted image inputs may be exposed to high severity vulnerabilities inherited from libvips. This could lead to potential compromise or denial of service depending on the nature of the vulnerabilities. No active exploitation has been reported yet.

Upgrade sharp to version 0.35.3 or later, which includes libvips 8.18.3 containing the fixes. If using a globally installed libvips, update it to version 8.18.3. As a temporary workaround, configure sharp to block decoding of GIF, TIFF, and VIPS images by adding sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }); to your code. No other immediate actions are indicated by the vendor advisory.