The plugin's composer.lock currently ships versions of guzzlehttp/guzzle and guzzlehttp/psr7 (pulled in transitively via cloudflare/sdk) that are affected by 5 moderate-severity advisories.
Affected packages (as locked today)
| Package |
Locked version |
guzzlehttp/guzzle |
7.10.0 |
guzzlehttp/psr7 |
2.8.0 |
Advisories
| # |
Package |
CVE |
Title |
Affected |
| 1 |
guzzlehttp/guzzle |
CVE-2026-55568 |
Silent HTTPS-proxy downgrade to cleartext |
< 7.12.1 |
| 2 |
guzzlehttp/guzzle |
CVE-2026-55767 |
Dot-only cookie domains match all hosts |
< 7.12.1 |
| 3 |
guzzlehttp/psr7 |
CVE-2026-48998 |
Host confusion via authority reinterpretation |
< 2.10.2 |
| 4 |
guzzlehttp/psr7 |
CVE-2026-49214 |
CRLF injection via URI host component |
< 2.10.2 |
| 5 |
guzzlehttp/psr7 |
CVE-2026-55766 |
CRLF injection in HTTP start-line serialization |
< 2.12.1 |
Suggested resolution
All five are fixed by a straightforward version bump — no override or constraint changes required. Both patched versions fall within the existing constraints (cloudflare/sdk requires guzzle ^7.0.1; guzzle 7.x requires psr7 ^2.8):
This bumps:
guzzlehttp/guzzle 7.10.0 → 7.14.1 (≥ 7.12.1)
guzzlehttp/psr7 2.8.0 → 2.12.5 (≥ 2.12.1)
guzzlehttp/promises 2.3.0 → 2.5.1 (dependency)
The plugin's
composer.lockcurrently ships versions ofguzzlehttp/guzzleandguzzlehttp/psr7(pulled in transitively viacloudflare/sdk) that are affected by 5 moderate-severity advisories.Affected packages (as locked today)
guzzlehttp/guzzleguzzlehttp/psr7Advisories
< 7.12.1< 7.12.1< 2.10.2< 2.10.2< 2.12.1Suggested resolution
All five are fixed by a straightforward version bump — no override or constraint changes required. Both patched versions fall within the existing constraints (
cloudflare/sdkrequires guzzle^7.0.1; guzzle 7.x requires psr7^2.8):This bumps:
guzzlehttp/guzzle 7.10.0 → 7.14.1 (≥ 7.12.1)
guzzlehttp/psr7 2.8.0 → 2.12.5 (≥ 2.12.1)
guzzlehttp/promises 2.3.0 → 2.5.1 (dependency)