http vulnerabilities
CVEs whose affected-version data names the http package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-104827High· 7.5react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without…
▾ Twilightreactphp · httpEPSS 0.43%via NVD
CVE-2026-84997High· 7.5PoCreact/http is an event-driven, streaming HTTP client and server implementation for ReactPHP
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body …
▾ Midnightreactphp · httpEPSS 0.66%via NVD