Quick answers
- Is CVE-2026-114112 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114112 being exploited in the wild.
- How severe is CVE-2026-114112?
- Informational severity, published 21 October 2026.
- Which products and versions are affected?
- Lovell Sharp before 0.35.4.
- Is there a fix for CVE-2026-114112?
- Yes: fixed in 0.35.4. Until then: Add the following code to prevent Sharp from decoding AVIF images: sharp.block({operation: ["VipsForeignLoadHeif"]}). Ensure your Node.js executable is compiled as a Position Independent Executable (PIE) for additional RCE protection. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114112 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-114112?
- Check whether you run Lovell Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.35.4
Add the following code to prevent Sharp from decoding AVIF images: sharp.block({operation: ["VipsForeignLoadHeif"]}). Ensure your Node.js executable is compiled as a Position Independent Executable (PIE) for additional RCE protection.
Technical details
Sharp before 0.35.4 bundles a vulnerable version of libheif with heap-based buffer overflow vulnerabilities (CVE-2026-84383 and GHSA-2jg2-4ch7-h545). An attacker can trigger remote code execution by supplying malicious AVIF/HEIF image input to applications using Sharp, exploiting the flaw in libheif's image decoding on glibc-based Linux systems. The attack requires the application to process untrusted images; a fix exists in Sharp 0.35.4 which upgrades to libheif 1.23.2.
Affected products
- lovell Sharp before 0.35.4
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory published
- 2026-10-21: advisory: NVD entry published