Composer react/http has 5 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-36032 | ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent | medium | 5.3 | >=0.7.0 and <1.7.0 | 1.7.0 |
| CVE-2023-26044 | ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits | medium | 5.3 | >=0.8.0 and <1.9.0 | 1.9.0 |
| CVE-2026-84997 | react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU | high | 7.5 | >=0.6.0 and <1.11.1 | 1.11.1 |
| CVE-2026-104827 | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS | high | 7.5 | >=1.0.0 and <1.11.1 | 1.11.1 |
| GHSA-g4f2-2pf3-2pwj | Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http | unknown | 0.0 | >=1.0.0 and <1.11.1 | 1.11.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked