Is guzzlehttp/guzzle 7.2 vulnerable?
Composer · 1 release from 7.2.0 to 7.2.0 · latest guzzlehttp/guzzle is 8.3.1 · checked 1 Nov 2026
Yes: 14 known advisories
Yes. guzzlehttp/guzzle 7.2.0, the last 7.2 release, is affected by 14 known security advisories (6 high, 8 medium), including CVE-2026-69246, CVE-2022-31091, CVE-2022-31090. Upgrade to 7.15.2 or later to fix all of them.
composer require guzzlehttp/guzzle:^7.15.2Advisories affecting guzzlehttp/guzzle 7.2.0
Guzzle: Noncanonical host can bypass host-based checks
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: URI fragments disclosed in redirect Referer headers
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Host-only cookie scope is not preserved
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Unbounded response cookies risk denial of service
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Affected
- <7.12.3
- Fixed in
- 7.12.3
Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected
- <7.14.2
- Fixed in
- 7.14.2
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
- Affected
- <7.12.1
- Fixed in
- 7.12.1
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
- Affected
- <7.12.1
- Fixed in
- 7.12.1
Change in port should be considered a change in origin
- Affected
- <6.5.8 · >=7.0.0 <7.4.5
- Fixed in
- 6.5.8, 7.4.5
CURLOPT_HTTPAUTH option not cleared on change of origin
- Affected
- <6.5.8 · >=7.0.0 <7.4.5
- Fixed in
- 6.5.8, 7.4.5
Failure to strip the Cookie header on change in host or HTTP downgrade
- Affected
- >=4.0.0 <6.5.7 · >=7.0.0 <7.4.4
- Fixed in
- 6.5.7, 7.4.4
Fix failure to strip Authorization header on HTTP downgrade
- Affected
- >=4.0.0 <6.5.7 · >=7.0.0 <7.4.4
- Fixed in
- 6.5.7, 7.4.4
Cross-domain cookie leakage in Guzzle
- Affected
- <6.5.6 · >=7.0.0 <7.4.3
- Fixed in
- 6.5.6, 7.4.3
Which of your client projects are still on guzzlehttp/guzzle 7.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact guzzlehttp/guzzle version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other guzzlehttp/guzzle versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.