next@16.2.11 bundles vulnerable sharp <0.35.0 (GHSA-f88m-g3jw-g9cj)

[carstrb]

Link to the code that reproduces this issue

GHSA-f88m-g3jw-g9cj

To Reproduce

1. Create an empty folder and with the following package.json:

   {
     "name": "next-sharp-audit-example",
     "private": true,
     "dependencies": {
       "next": "16.2.11",
       "react": "^19.0.0",
       "react-dom": "^19.0.0"
     }
   }

2. Install dependencies

npm install

3. Inspect the resolved dependency tree

npm ls sharp next

4. Run an audit

npm audit

Current vs. Expected behavior

Current

next@16.2.11 resolves sharp@0.34.5. Running npm audit reports GHSA-f88m-g3jw-g9cj.

Expected

A release should resolve a non-vulnerable sharp version or guidance should exist for a supported workaround.

Provide environment information

## Environment

- Next.js version: 16.2.11
- Node.js version: 22.x
- npm version: 10.x
- OS: macOS

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

No response

[icyJoseph]

Just collecting some data here for now:

• chore(deps): bump sharp@0.35.3 #95507 - updates sharp to 0.35.3

[tjmitchell1]

Also affecting version 15.5.21

[0aps]

this is a real problem for most of us in 16.2. It would be awesome to get this fixed there ... (seems like this is fine in 16.3)

@icyJoseph

[icyJoseph]

Hi,

I do believe, that because sharp is an optionalDependency it is through your package manager configs that it ends up installed, or not. You can take control of that with an override.

  "pnpm": {
    "overrides": {
      "sharp": "0.35"
    }
  }

This worked for the repo I am working with right now. I guess for npm, or yarn it is slightly different.

• npm "overrides": { "sharp": "0.35" }
• and yarn "resolutions": { "sharp": "0.35" }

However, there seems to be issues in Vercel with that version, see lovell/sharp#4567. It seems fixed on canary though, which might justify patching 16.2.

[0aps]

@icyJoseph patching on 16.2 would be so awesome 😃

[soulchild]

@icyJoseph

However, there seems to be issues in Vercel with that version, see lovell/sharp#4567. It seems fixed on canary though, which might justify patching 16.2.

I tried overriding sharp (npm), but my app crashes at runtime (self-hosted on K8s):

Error: Could not load the "sharp" module using the linuxmusl-x64 runtime ERR_DLOPEN_FAILED: Error loading shared library libvips-cpp.so.8.18.3: No such file or directory (needed by /app/node_modules/@img/sharp-linuxmusl-x64/lib/sharp-linuxmusl-x64-0.35.3.node)

Looks like a Turbopack issue to me. Depending on when 16.3 is scheduled to be released, the fix really should be backported to 16.2.

[icyJoseph]

@soulchild could you confirm that if you use 16.3, then that runtime issue doesn't happen? Trying to clearly understand if we need to backport two things:

• the bump of the optional sharp dep
• w.e. fixed Turbopack to make sharp 0.35+ work (the runtime issue)

[DaanRoet]

I guess we can also add postcss to the list of vulnerable deps (GHSA-6g55-p6wh-862q)

[arealesramirez]

I guess we can also add postcss to the list of vulnerable deps (GHSA-6g55-p6wh-862q)

You beat me to posting this. My CI pipeline is now blocked because of the postcss high vulnerability

[soulchild]

could you confirm that if you use 16.3, then that runtime issue doesn't happen? Trying to clearly understand if we need to backport two things:
* the bump of the optional sharp dep
* w.e. fixed Turbopack to make sharp 0.35+ work (the runtime issue)

@icyJoseph I rebuilt my Docker image with Next.js 16.3.0-canary.95 and the problem went away.