StackRadar

CVE-2026-114112

High

Advisory

Published 8 Sept 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
101
of 18,219 indexed, latest versions
Container images
102
deployed by those charts
Fix available
1 of 1
affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 101 of 18,219 indexed charts deploy, on 102 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.27.2, 0.28.1, 0.29.0, 0.29.2+16 more0.35.4102
OSV records
GHSA-rgj7-g3m4-5g8c

Charts affected

101 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.1.01See more

rocketchat rocketchat-server 7.1.0

1 container image this version deploys carries CVE-2026-114112.

Container imageDigestPackageFixed in
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.4

Open the chart page →

—
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.4

Open the chart page →

84,023
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.4

Open the chart page →

8,180
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.4

Open the chart page →

6,685
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.4

Open the chart page →

1,324
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.4

Open the chart page →

5,653
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.4

Open the chart page →

3,466
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.4

Open the chart page →

35,388
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.4

Open the chart page →

101,046
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.4

Open the chart page →

5,618
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,867
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,847
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.4
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.4

Open the chart page →

43,506
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.4

Open the chart page →

9,890
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

2,969
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.4

Open the chart page →

4,981
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.4

Open the chart page →

3,464
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.4

Open the chart page →

22,692
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.4

Open the chart page →

1,619
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.4

Open the chart page →

837
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.4

Open the chart page →

774
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.4

Open the chart page →

16,118
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.4

Open the chart page →

8,587
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.4

Open the chart page →

10,479
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.4

Open the chart page →

3,333
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.4

Open the chart page →

6,346
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.4

Open the chart page →

13,723
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.4

Open the chart page →

11,457
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.4

Open the chart page →

22,516
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.4

Open the chart page →

17,203
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.4

Open the chart page →

6,259
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.4

Open the chart page →

1,645
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.4

Open the chart page →

5,016
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.4

Open the chart page →

6,558
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,867
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
sharp@0.27.2
0.35.4

Open the chart page →

192,867
immichbear0.1.11 of 2See more

immich bear 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
sharp@0.34.5
0.35.4

Open the chart page →

7,885
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
sharp@0.30.7
0.35.4

Open the chart page →

5,415
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sharp@0.33.5
0.35.4

Open the chart page →

3,460
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,155
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,155
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,155
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
sharp@0.30.7
0.35.4

Open the chart page →

7,083
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
sharp@0.33.5
0.35.4

Open the chart page →

3,337
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
sharp@0.33.5
0.35.4

Open the chart page →

56,473
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
sharp@0.33.5
0.35.4

Open the chart page →

5,572
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
sharp@0.32.6
0.35.4

Open the chart page →

3,391
dashboardedu1.0.01 of 1See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
sharp@0.33.4
0.35.4

Open the chart page →

1,635
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
sharp@0.32.6
0.35.4

Open the chart page →

5,548
double-takegeek-cookbookVerified publisher2.3.21 of 1See more

double-take geek-cookbook 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
jakowenko/double-take:1.6.0b858bac9e32a
sharp@0.29.2
0.35.4

Open the chart page →

86,926

Container images carrying it

102 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4
3
joplin/server:3.7.2:latest3f7b852959aa
sharp@0.34.5
0.35.4
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
sharp@0.34.5
0.35.4
3
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
sharp@0.32.6
0.35.4
2
sysnet4admin/dashboard:bluec5bd3bb1b5a6
sharp@0.33.4
0.35.4
2
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
sharp@0.34.5
0.35.4
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
sharp@0.34.1
0.35.4
2
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.4
1
alquimiaai/studio:certification38a1f0341982
sharp@0.34.4
0.35.4
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
sharp@0.34.3
0.35.4
1
assistiot/dlt_api:2.1.0c8a170683be7
sharp@0.27.2
0.35.4
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
sharp@0.30.7
0.35.4
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.4
1
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.4
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.4
1
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.4
1
directus/directus:11.1.0e3c8bb975350
sharp@0.33.5
0.35.4
1
documenso/documenso:v1.8.17f16a9449f18
sharp@0.32.6
0.35.4
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.4
1
evoapicloud/evolution-api:latest966625532d90
sharp@0.34.5
0.35.4
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
sharp@0.32.6
0.35.4
1
fosrl/pangolin:1.13.0c32ad797ab96
sharp@0.34.4
0.35.4
1
helmforge/opencut:v0.3.0bf11156e0ab5
sharp@0.34.5
0.35.4
1
ianw/quickchart:v1.7.1dc49dd460c37
sharp@0.30.7
0.35.4
1
jakowenko/double-take:1.6.0b858bac9e32a
sharp@0.29.2
0.35.4
1
joplin/server:3.0-beta52af57880c0e
sharp@0.33.3
0.35.4
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
sharp@0.34.5
0.35.4
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
sharp@0.34.5
0.35.4
1
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.4
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.4
1
langgenius/dify-web:1.0.0d64914ff0d6d
sharp@0.33.5
0.35.4
1
lbenicio/helm-pilot:0.2.54594a2632510
sharp@0.34.5
0.35.4
1
library/ghost:6.37.01ef2e532ca4d
sharp@0.34.5
0.35.4
1
library/ghost:6.25.12654b1e90413
sharp@0.34.5
0.35.4
1
library/ghost:6.41.129773d6be407
sharp@0.34.5
0.35.4
1
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.4
1
library/ghost:5.79.083f7bf209844
sharp@0.32.6
0.35.4
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
sharp@0.33.5
0.35.4
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
sharp@0.30.7
0.35.4
1
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.4
1
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.4
1
n8nio/n8n:1.115.1ed16e560c40e
sharp@0.33.5
0.35.4
1
nocodb/nocodb:0.258.06779a4ddedf2
sharp@0.33.5
0.35.4
1
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.4
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.4
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
sharp@0.33.5
0.35.4
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.4
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
sharp@0.32.6
0.35.4
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.