sharp vulnerability in libwebp dependency CVE-2023-4863
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
## Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. ## Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. ## How to resolve this? ### Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. ### Using a globally-installed libvips? Please ensure you are using the latest libwebp 1.3.2. ## Possible workaround Add the following to your code to prevent sharp from decoding WebP images. ```js sharp.block({ operation: ["VipsForeignLoadWebp"] }); ```
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sharp (npm) | before 0.32.6 | 0.32.6 | Patch available | GHSA-54xq-cgqr-rpm3 |
- sharp (npm) Vendor— Affected before 0.32.6 Fixed in 0.32.6 Patch available GHSA-54xq-cgqr-rpm3
Remediation
- Fix · GHSA-54xq-cgqr-rpm3 sharp (npm) Fixed in 0.32.6 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-54xq-cgqr-rpm3
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences