security: bump sharp to patch libheif (HEIF Heist / CVE-2026-32882, CVE-2026-84383) - #513
Merged
Merged
Conversation
…Heist) sharp <0.35.4 bundles @img/sharp-libvips 1.2.4 -> libheif 1.20.2, vulnerable to the "HEIF Heist" heap overflows (CVE-2026-32882 <=1.21.2, CVE-2026-84383 1.22.0-1.23.1) reachable when decoding untrusted HEIC/AVIF images. This handler decodes untrusted images from S3 via sharp -> libvips -> libheif and is exposed through a public Lambda Function URL (auth NONE). sharp 0.35.4 pulls @img/sharp-libvips 1.3.3 -> libheif 1.23.2, which fixes both. Lockfile regenerated with `npm install --package-lock-only`.
The libheif/libvips bump re-encodes the sample images (different but valid bytes), which broke two byte-exact golden assertions: - test/index.spec.ts: JPEG body (EXIF density re-encoded) -> updated to the exact bytes CI (linux-x64) produced, taken from the failed run log. - test/image-handler/crop.spec.ts: image_png_white_1x1 (PNG re-encoded by the new libvips) -> regenerated locally; bytes cross-checked against the CI diff window (identical), PNG output is platform-deterministic. No behavior change; both remain valid 1x1 outputs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump
sharp^0.34.5→^0.35.4insource/image-handler.sharp0.34.5 bundled@img/sharp-libvips1.2.4 → libheif 1.20.2sharp0.35.4 bundles@img/sharp-libvips1.3.3 → libheif 1.23.2Lockfile regenerated with
npm install --package-lock-only(nonode_modulesbuild here — CI installs).Why
The HEIF Heist advisory (CVE-2026-32882 for libheif ≤ 1.21.2, CVE-2026-84383 for 1.22.0–1.23.1) describes heap buffer overflows in
libheif/libde265, reachable when a service decodes untrusted HEIC/AVIF images — memory corruption up to RCE.This handler decodes untrusted images from the
master-imagesS3 bucket throughsharp → libvips → libheif, and is exposed via a public Lambda Function URL (authorization_type = NONE). The bundledlibheif(1.20.2) was vulnerable to CVE-2026-32882.sharp0.35.4 pulls the patchedlibheif1.23.2, which fixes both CVEs.Wiz raises no finding for this because the CVE is filed against
libheifwhile the SBOM only tracks thelibvipswrapper version — see the fleet-wide SBOM indicatorlibvips < 1.3.3.