Is CVE-2026-114111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114111 being exploited in the wild.

How severe is CVE-2026-114111?

Informational severity, published 21 October 2026.

Am I affected by CVE-2026-114111?

Check whether you run Lovell Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114111: sharp memory-related vulnerability in librsvg dependency

CVE-2026-114111 · Severity: info · Published 2026-10-21

sharp is an image processing library for Node.js used by many web applications to resize and manipulate images. Versions before 0.35.5 bundle a vulnerable version of librsvg, a library that decodes SVG (vector graphic) files. An attacker who tricks an application into processing a malicious SVG image could execute arbitrary code on the affected system, potentially compromising server security and data.

Technologies: Lovell Sharp. Vendors: Lovell.

Quick answers

Is CVE-2026-114111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114111 being exploited in the wild.
How severe is CVE-2026-114111?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Lovell Sharp before 0.35.5.
Is there a fix for CVE-2026-114111?: Yes: fixed in 0.35.5. Until then: Prevent sharp from decoding SVG images by adding sharp.block({operation:["VipsForeignLoadSvg"]}) to your code. Additionally, ensure your Node.js executable is compiled as a Position Independent Executable (PIE), which most Linux distributions do by default but official Node.js binaries may not.</anigation> <parameter name="attack_vector">["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114111 attacked?: It is in a software library.
Am I affected by CVE-2026-114111?: Check whether you run Lovell Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.35.5

Prevent sharp from decoding SVG images by adding sharp.block({operation:["VipsForeignLoadSvg"]}) to your code. Additionally, ensure your Node.js executable is compiled as a Position Independent Executable (PIE), which most Linux distributions do by default but official Node.js binaries may not.</anigation> <parameter name="attack_vector">["local"]

Technical details

A use-after-free memory vulnerability in the bundled librsvg 2.62.x (CVE-2026-96889) can be triggered when sharp decodes specially crafted SVG images. The vulnerability requires specific runtime conditions on glibc-based Linux systems to achieve code execution. Exploitation requires an attacker to supply a malicious SVG file for processing by the application.

Affected products

lovell sharp before 0.35.5

Timeline

2026-09-30: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.