Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS8 OCT
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
no fix yet
6 OCT
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
fixed in 1.11.0
1 OCT
Zod can exhaust memory while validating oversized constrained collections
fixed in 4.6.6
30 SEP
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
no fix yet
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
no fix yet
29 SEP
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
no fix yet
28 SEP
Accessibility Audit 1.5.0 is a critical release
fixed in 1.5.0
Order Lifecycle 2.0.0 is a critical release
fixed in 2.0.0
Clicky Analytics 1.1.0 is a critical release
fixed in 1.0.2 · 1.1.0
Stripe Reconciler 1.1.0 is a critical release
fixed in 1.1.0
24 SEP
zbateson/mail-mime-parser has CRLF header injection via attachment filename
fixed in 3.0.6 · 4.0.2
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
fixed in 3.0.6 · 4.0.2
23 SEP
Formie: Missing authorization on sent notification resend modal exposes submission PII
fixed in 2.2.23 · 3.1.31
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
fixed in 2.2.23 · 3.1.31
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
fixed in 2.2.23 · 3.1.31
20 SEP
Servd Assets and Helpers 2.11.7 is a critical release
fixed in 2.11.7 · 3.7.6 · 4.2.7
18 SEP
source-map-js allows event-loop denial of service through indexed source-map section offsets
fixed in 1.2.2
15 SEP
CVE-2026-108082: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
fixed in 5.4.54 · 6.4.46 · 7.4.19 · 8.1.7
8 SEP
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
fixed in 3.3.0
2 SEP
Livewire DOM-based cross-site scripting during client-side state handling
no fix yet
1 SEP
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
fixed in 2.10.0
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
fixed in 2.9.1
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
fixed in 2.9.1
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
fixed in 2.9.1
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.