CVE-2026-114112 lovell CVE debrief

Who should care

Users of sharp, a popular image processing library for Node.js, should be aware of the vulnerabilities in libheif and take steps to mitigate them. This includes upgrading to sharp version 0.35.4 or later and ensuring libheif is updated to version 1.23.2 or later.

Why it matters

CVE-2026-114112: Vulnerabilities in libheif affect sharp, a popular image processing library for Node.js, potentially leading to RCE attacks on glibc-based Linux systems. Users should upgrade to sharp version 0.35.4 or later to mitigate the vulnerability.

• Potential RCE attacks on glibc-based Linux systems
• Exposure of sensitive data or systems
• Disruption of image processing services
• Compromise of Node.js applications using sharp

Technical summary

The vulnerabilities in libheif affecting sharp can lead to possible remote code execution (RCE) on glibc-based Linux systems when processing untrusted input with versions of sharp prior to 0.35.4. The attack vector is network-based, but sharp does not provide networking features, down-rating the severity to High using CVSSv4. Affected users should upgrade to sharp version 0.35.4 or later, which includes libheif 1.23.2, and consider implementing workarounds to prevent sharp from decoding AVIF images. Ensure you are using a node executable binary compiled as a Position Independent Executable (PIE) to further mitigate potential risks.

Defensive priority

Upgrade to sharp version 0.35.4 or later to prevent potential RCE attacks.

Recommended defensive actions

• Upgrade to sharp version 0.35.4 or later
• Ensure libheif is updated to version 1.23.2 or later
• Implement workarounds to prevent sharp from decoding AVIF images
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerabilities in libheif affecting sharp. The vulnerabilities can lead to possible RCE on glibc-based Linux systems. The source item provides patches and workarounds for affected users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.