sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
Advisory GHSA-rgj7-g3m4-5g8c, published September 8, 2026, rates sharp before 0.35.4 as high severity, with 0.35.4 as the patch. The two upstream libheif vulnerabilities it wraps are rated critical under CVSSv3 and can lead to remote code execution on glibc-based Linux under certain conditions. The sharp advisory scored the combined issue high under CVSSv4 instead.
The gap between the two scores is deliberate. The advisory explains that sharp does not provide any networking features, which is where CVSSv4 puts most of the exposure, and it tells readers to weigh the Subsequent System Impact. It also references CVE-2026-84383 and warns that a process needs a PIE-compiled node binary, noting the official Node.js builds are not PIE-compiled.
That distinction matters for how you triage. If you resize images in a serverless function or process untrusted uploads, the heif decoder is parsing attacker-controlled bytes, and no networking feature in sharp limits that reach. libheif itself calls the pair critical. The patch is a one-line version bump: 0.35.4 shipped August 26, 2026 and is the current latest.
Upgrade to 0.35.4 where you can. If you are pinned and cannot move, disable AVIF decoding with sharp.block({ operation: ["VipsForeignLoadHeif"] }); and check whether your node binary is PIE-compiled, because the official builds are not. Anywhere you accept untrusted uploads, treat this one as urgent rather than scheduled.
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
1 source
Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
1 source
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources