Is guzzlehttp/guzzle 7.15 vulnerable?
Composer · 7 releases from 7.15.0 to 7.15.6 · latest guzzlehttp/guzzle is 8.3.1 · checked 1 Nov 2026
No known advisories in the last release
guzzlehttp/guzzle 7.15.6, the last 7.15 release, has no known advisories. 5 advisories affect earlier 7.15.x releases, so update to 7.15.6.
composer require guzzlehttp/guzzle:^7.15.6Fixed within 7.15.x, affecting earlier releases
Guzzle: Noncanonical host can bypass host-based checks
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: URI fragments disclosed in redirect Referer headers
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Host-only cookie scope is not preserved
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Unbounded response cookies risk denial of service
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Which of your client projects are still on guzzlehttp/guzzle 7.15?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact guzzlehttp/guzzle version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other guzzlehttp/guzzle versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.