Version Details and Security Vulnerabilities

📦

sharp

0.30.7

Comparision Betweeen 0.30.7 and 0.30.6

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

Unpacked Size

481.87 KB

481.58 KB

Security Vulnerabilities

This site is an independent open-source project and is not affiliated with, endorsed by, or sponsored by npm, Inc. or GitHub, Inc. The name “npm” is a registered trademark of npm, Inc., used here solely to describe compatibility and reference publicly available npm package data.

Version Details and Security Vulnerabilities

📦

sharp

0.30.7

Comparision Betweeen 0.30.7 and 0.30.6

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

Unpacked Size

481.87 KB

481.58 KB

Security Vulnerabilities

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 0.30.7 of the package sharp.

All Security Vulnerabilities

All the vulnerabilities related to the version 0.30.7 of the package

Summary:

sharp vulnerability in libwebp dependency CVE-2023-4863

Details:

Overview

sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.

Who does this affect?

Almost anyone processing untrusted input with versions of sharp prior to 0.32.6.

How to resolve this?

Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.

Using a globally-installed libvips?

Please ensure you are using the latest libwebp 1.3.2.

Possible workaround

Add the following to your code to prevent sharp from decoding WebP images.

sharp.block({ operation: ["VipsForeignLoadWebp"] });

Details about sharp@0.30.7

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 0.30.7 of the package sharp.

All Security Vulnerabilities

All the vulnerabilities related to the version 0.30.7 of the package

Summary:

sharp vulnerability in libwebp dependency CVE-2023-4863

Details:

Overview

sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr.

Who does this affect?

Almost anyone processing untrusted input with versions of sharp prior to 0.32.6.

How to resolve this?

Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.

Using a globally-installed libvips?

Please ensure you are using the latest libwebp 1.3.2.

Possible workaround

Add the following to your code to prevent sharp from decoding WebP images.

sharp.block({ operation: ["VipsForeignLoadWebp"] });

Details about sharp@0.30.7

Version Details and Security Vulnerabilities

sharp

Comparision Betweeen 0.30.7 and 0.30.6

Security Vulnerabilities

Version Details and Security Vulnerabilities

sharp

Comparision Betweeen 0.30.7 and 0.30.6

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Overview

Who does this affect?

How to resolve this?

Using prebuilt binaries provided by sharp?

Using a globally-installed libvips?

Possible workaround

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Overview

Who does this affect?

How to resolve this?

Using prebuilt binaries provided by sharp?

Using a globally-installed libvips?

Possible workaround

Version Details and Security Vulnerabilities

sharp

Comparision Betweeen 0.30.7 and 0.30.6

Security Vulnerabilities

Version Details and Security Vulnerabilities

sharp

Comparision Betweeen 0.30.7 and 0.30.6

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

sharp@0.30.7 GHSA-54xq-cgqr-rpm3 7.8

Overview

Who does this affect?

How to resolve this?

Using prebuilt binaries provided by sharp?

Using a globally-installed libvips?

Possible workaround

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

sharp@0.30.7 GHSA-54xq-cgqr-rpm3 7.8

Overview

Who does this affect?

How to resolve this?

Using prebuilt binaries provided by sharp?

Using a globally-installed libvips?

Possible workaround