Is guzzlehttp/guzzle 7.9 vulnerable?
Composer · 4 releases from 7.9.0 to 7.9.3 · latest guzzlehttp/guzzle is 8.3.1 · checked 1 Nov 2026
Yes: 9 known advisories
Yes. guzzlehttp/guzzle 7.9.3, the last 7.9 release, is affected by 9 known security advisories (1 high, 8 medium), including CVE-2026-69246, CVE-2026-69245, CVE-2026-67354. Upgrade to 7.15.2 or later to fix all of them.
composer require guzzlehttp/guzzle:^7.15.2Advisories affecting guzzlehttp/guzzle 7.9.3
Guzzle: Noncanonical host can bypass host-based checks
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
- Affected
- <7.15.2 · >=8.0.0 <8.0.1
- Fixed in
- 7.15.2, 8.0.1
Guzzle: URI fragments disclosed in redirect Referer headers
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Host-only cookie scope is not preserved
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Unbounded response cookies risk denial of service
- Affected
- <7.15.1
- Fixed in
- 7.15.1
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
- Affected
- <7.12.3
- Fixed in
- 7.12.3
Guzzle: Proxy-Authorization headers can be sent to origin servers
- Affected
- <7.14.2
- Fixed in
- 7.14.2
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
- Affected
- <7.12.1
- Fixed in
- 7.12.1
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
- Affected
- <7.12.1
- Fixed in
- 7.12.1
Which of your client projects are still on guzzlehttp/guzzle 7.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact guzzlehttp/guzzle version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other guzzlehttp/guzzle versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.