Is guzzlehttp/guzzle 7.13 vulnerable?
Composer · 4 releases from 7.13.0 to 7.13.3 · latest guzzlehttp/guzzle is 8.3.1 · checked 1 Nov 2026
Yes: 6 known advisories
Yes. guzzlehttp/guzzle 7.13.3, the last 7.13 release, is affected by 6 known security advisories (1 high, 5 medium), including CVE-2026-69246, CVE-2026-69245, CVE-2026-67354. Upgrade to 7.15.2 or later to fix all of them.
composer require guzzlehttp/guzzle:^7.15.2Advisories affecting guzzlehttp/guzzle 7.13.3
Guzzle: Noncanonical host can bypass host-based checks
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: URI fragments disclosed in redirect Referer headers
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Host-only cookie scope is not preserved
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Unbounded response cookies risk denial of service
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected
- <7.14.2
- Fixed in
- 7.14.2
Which of your client projects are still on guzzlehttp/guzzle 7.13?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact guzzlehttp/guzzle version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other guzzlehttp/guzzle versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.