# CVE-2026-114111: sharp memory-related vulnerability in librsvg dependency

Source: https://junglewise.ai/threats/cve-2026-114111-sharp-before-0-35-5-bundles-a-librsvg-dependency-affected-by-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114111 · Severity: info · Published 2026-10-21

sharp is an image processing library for Node.js used by many web applications to resize and manipulate images. Versions before 0.35.5 bundle a vulnerable version of librsvg, a library that decodes SVG (vector graphic) files. An attacker who tricks an application into processing a malicious SVG image could execute arbitrary code on the affected system, potentially compromising server security and data.

Technologies: [Lovell Sharp](https://junglewise.ai/threats/technologies/lovell-sharp). Vendors: [Lovell](https://junglewise.ai/threats/vendors/lovell).

## Quick answers

**Is CVE-2026-114111 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114111 being exploited in the wild.

**How severe is CVE-2026-114111?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Lovell Sharp before 0.35.5.

**Is there a fix for CVE-2026-114111?** Yes: fixed in 0.35.5. Until then: Prevent sharp from decoding SVG images by adding sharp.block({operation:["VipsForeignLoadSvg"]}) to your code. Additionally, ensure your Node.js executable is compiled as a Position Independent Executable (PIE), which most Linux distributions do by default but official Node.js binaries may not.</anigation>
<parameter name="attack_vector">["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114111 attacked?** It is in a software library.

**Am I affected by CVE-2026-114111?** Check whether you run Lovell Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.35.5

Prevent sharp from decoding SVG images by adding sharp.block({operation:["VipsForeignLoadSvg"]}) to your code. Additionally, ensure your Node.js executable is compiled as a Position Independent Executable (PIE), which most Linux distributions do by default but official Node.js binaries may not.</anigation>
<parameter name="attack_vector">["local"]

## Technical details

A use-after-free memory vulnerability in the bundled librsvg 2.62.x (CVE-2026-96889) can be triggered when sharp decodes specially crafted SVG images. The vulnerability requires specific runtime conditions on glibc-based Linux systems to achieve code execution. Exploitation requires an attacker to supply a malicious SVG file for processing by the application.

## Affected products

- lovell sharp before 0.35.5

## Timeline

- 2026-09-30: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)
- [https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability](https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability)

## Related threats

- [Sharp image processing library bundled vulnerable libvips](https://junglewise.ai/threats/cve-2026-114113-sharp-before-0-35-0-bundles-a-version-of-libvips-affected-by)
- [Sharp remote code execution in bundled libheif](https://junglewise.ai/threats/cve-2026-114112-sharp-before-0-35-4-bundles-a-vulnerable-libheif-dependency-that)
- [sharp memory corruption in librsvg dependency](https://junglewise.ai/threats/sharp-vulnerability-in-librsvg-dependency-b5d03f31)