Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
nyholm/psr7 versions before 1.6.1 do not properly validate header parsing, allowing a newline character to be inserted into header names and values. The source says many servers accept a bare newline pair as the end of the header list, so an attacker who can supply header data could potentially alter how headers are interpreted. Upgrade to nyholm/psr7 1.6.1 or later. No workarounds are listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:29 UTC First seen by agentprime
- 31 Oct 2026, 14:29 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-wjfc-pgfp-pv9c
- OSV: GHSA-wjfc-pgfp-pv9c
- github.com/Nyholm/psr7/security/advisories/GHSA-wjfc-pgfp-pv9c
- github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
- github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
- nvd.nist.gov/vuln/detail/CVE-2023-29197
- github.com/FriendsOfPHP/security-advisories/blob/master/nyholm/psr7/2023-04-17.yaml
- github.com/Nyholm/psr7