npm package report

Is sharp safe?

5 known vulnerabilities, worst severity HIGH.

// reach

18 direct dependencies

8 carry known advisories, worst CRITICAL

170 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss
0.0
high

severity band, no base score published

epss
not scored

chance of exploitation in 30 days

xyz score
0.0
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-wq5f-xc86-pv6w, the advisory selected below

// 5 advisories

GHSA-wq5f-xc86-pv6w

HIGH
// impact

A memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.

// using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.

// using a globally-installed librsvg?

Please ensure you are using the latest librsvg 2.63.2.

// workarounds

Add the following to your code to prevent sharp from decoding SVG images.

sharp.block({ operation: ["VipsForeignLoadSvg"] });

To avoid RCE, ensure you are using a node executable binary compiled as a Position Independent Executable (PIE). Most Linux package managers already use this security-hardening feature however be warned that the "official" Node.js binaries do not. 1

Checked 2026-10-10 at 18:38 UTC. The most recent advisory here was published 2026-10-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.