Is guzzlehttp/guzzle 7.14 vulnerable?
Composer · 3 releases from 7.14.0 to 7.14.2 · latest guzzlehttp/guzzle is 8.3.1 · checked 2 Nov 2026
Yes: 5 known advisories
Yes. guzzlehttp/guzzle 7.14.2, the last 7.14 release, is affected by 5 known security advisories (1 high, 4 medium), including CVE-2026-69246, CVE-2026-69245, CVE-2026-67354. 1 more affects earlier 7.14.x releases. Upgrade to 7.15.2 or later to fix all of them.
composer require guzzlehttp/guzzle:^7.15.2Advisories affecting guzzlehttp/guzzle 7.14.2
Guzzle: Noncanonical host can bypass host-based checks
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: URI fragments disclosed in redirect Referer headers
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Host-only cookie scope is not preserved
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Unbounded response cookies risk denial of service
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Fixed within 7.14.x, affecting earlier releases
Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected
- <7.14.2
- Fixed in
- 7.14.2
Which of your client projects are still on guzzlehttp/guzzle 7.14?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact guzzlehttp/guzzle version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other guzzlehttp/guzzle versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.