PatchClock

PHP security digest · Packages

react/http security advisories

2 advisories we have followed since September 2026, 2 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 15 Oct 2026

    react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

    Fixed in 1.11.1 · CVE-2026-104827

  2. High 17 Sep 2026

    react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

    Fixed in 1.11.1 · CVE-2026-84997

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including react/http, and the version that fixes it.