{"id":684917,"name":"react/http","ecosystem":"packagist","description":"Event-driven, streaming HTTP client and server implementation for ReactPHP","homepage":"","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/reactphp/http","keywords_array":["http","http client","client","https","server","async","streaming","event-driven","reactphp","http server","psr-7"],"namespace":"react","versions_count":41,"first_release_published_at":"2012-07-11T15:43:22.000Z","latest_release_published_at":"2026-09-09T07:08:28.000Z","latest_release_number":"v1.11.1","last_synced_at":"2026-09-29T16:19:19.072Z","created_at":"2022-04-07T10:53:39.552Z","updated_at":"2026-09-30T08:18:11.076Z","registry_url":"https://packagist.org/packages/react/http#","install_command":"composer require react/http","documentation_url":null,"metadata":{"funding":[{"url":"https://opencollective.com/reactphp","type":"open_collective"}]},"repo_metadata":{"id":3249878,"uuid":"4287609","full_name":"reactphp/http","owner":"reactphp","description":"Event-driven, streaming HTTP client and server implementation for ReactPHP.","archived":false,"fork":false,"pushed_at":"2026-09-09T07:10:17.000Z","size":1262,"stargazers_count":781,"open_issues_count":22,"forks_count":166,"subscribers_count":39,"default_branch":"3.x","last_synced_at":"2026-09-19T10:33:12.251Z","etag":null,"topics":["http","http-client","http-server","https","php","reactphp","response-stream","streaming-request","streaming-response"],"latest_commit_sha":null,"homepage":"https://reactphp.org/http/","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/reactphp.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["reactphp","clue","WyriHaximus"],"open_collective":"reactphp"}},"created_at":"2012-05-10T17:31:28.000Z","updated_at":"2026-09-10T15:58:04.000Z","dependencies_parsed_at":"2026-08-25T00:34:05.389Z","dependency_job_id":null,"html_url":"https://github.com/reactphp/http","commit_stats":{"total_commits":540,"total_committers":40,"mean_commits":13.5,"dds":0.6981481481481482,"last_synced_commit":"fc5f0a6739ba4a10de3847bab4688c602e5fe948"},"previous_names":[],"tags_count":40,"template":false,"template_full_name":null,"purl":"pkg:github/reactphp/http","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reactphp","download_url":"https://codeload.github.com/reactphp/http/tar.gz/refs/heads/3.x","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/sbom","scorecard":{"id":766034,"data":{"date":"2025-08-11","repo":{"name":"github.com/reactphp/http","commit":"11b03a2776e07f4c02c17123ea59ec364ad91789"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.5,"checks":[{"name":"Code-Review","score":9,"reason":"Found 13/14 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":2,"reason":"2 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 29 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch '3.x'","Warn: branch protection not enabled for branch '1.x'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}}]},"last_synced_at":"2025-08-23T00:49:50.574Z","repository_id":3249878,"created_at":"2025-08-23T00:49:50.574Z","updated_at":"2025-08-23T00:49:50.574Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37528475,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-20T02:00:06.856Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"reactphp","name":"ReactPHP","uuid":"1696866","kind":"organization","description":"Event-driven, non-blocking I/O with PHP.","email":null,"website":"https://reactphp.org","location":null,"twitter":"reactphp","company":null,"icon_url":"https://avatars.githubusercontent.com/u/1696866?v=4","repositories_count":19,"last_synced_at":"2024-10-29T15:53:55.340Z","metadata":{"has_sponsors_listing":true,"funding":{"github":["reactphp","clue","WyriHaximus"],"open_collective":"reactphp"}},"html_url":"https://github.com/reactphp","funding_links":["https://github.com/sponsors/reactphp","https://github.com/sponsors/clue","https://github.com/sponsors/WyriHaximus","https://opencollective.com/reactphp"],"total_stars":17267,"followers":361,"following":0,"created_at":"2022-11-02T16:32:31.740Z","updated_at":"2024-10-29T15:53:55.340Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reactphp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reactphp/repositories"},"tags":[{"name":"v1.11.0","sha":"8db02de41dcca82037367f67a2d4be365b1c4db9","kind":"tag","published_at":"2024-11-20T15:24:33.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.11.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.11.0/manifests"},{"name":"v1.10.0","sha":"8111281ee57f22b7194f5dba225e609ba7ce4d20","kind":"tag","published_at":"2024-03-27T17:22:24.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.10.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.10.0/manifests"},{"name":"v1.9.0","sha":"bb3154dbaf2dfe3f0467f956a05f614a69d5f1d0","kind":"tag","published_at":"2023-04-26T10:29:52.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.9.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.9.0/manifests"},{"name":"v1.8.0","sha":"aa7512ee17258c88466de30f9cb44ec5f9df3ff3","kind":"tag","published_at":"2022-09-29T12:56:01.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.8.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.8.0/manifests"},{"name":"v1.7.0","sha":"4a1e85382e8c2a9e0fdb8ac04e94585da2083bfa","kind":"tag","published_at":"2022-08-23T12:31:37.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.7.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.7.0/manifests"},{"name":"v1.6.0","sha":"59961cc4a5b14481728f07c591546be18fa3a5c7","kind":"tag","published_at":"2022-02-03T13:17:42.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.6.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.6.0/manifests"},{"name":"v1.5.0","sha":"8a0fd7c0aa74f0db3008b1e47ca86c613cbb040e","kind":"tag","published_at":"2021-08-04T12:25:10.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.5.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.5.0/manifests"},{"name":"v1.4.0","sha":"b008fb855ac446e46fab9f3eebb23a797f311595","kind":"tag","published_at":"2021-07-11T13:03:33.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.4.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.4.0/manifests"},{"name":"v1.3.0","sha":"bc537273d11ee769c723a830e63aa33c0c35a530","kind":"tag","published_at":"2021-04-11T18:07:52.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.3.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.3.0/manifests"},{"name":"v1.2.0","sha":"badb0a87890e14b9cdfa3aec3ba1aafd900401ac","kind":"tag","published_at":"2020-12-04T13:05:01.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.2.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"754b0c18545d258922ffa907f3b18598280fdecd","kind":"tag","published_at":"2020-09-11T11:01:55.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.1.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"865694453c95122f8972b9ed7961efb3c517fc5e","kind":"tag","published_at":"2020-07-11T13:29:49.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v1.0.0","html_url":"https://github.com/reactphp/http/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v1.0.0/manifests"},{"name":"v0.8.7","sha":"9aa446fd86745403a09c315c90d4e464fd84382b","kind":"tag","published_at":"2020-07-05T11:32:37.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.7","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.7/manifests"},{"name":"v0.8.6","sha":"248202e57195d06a4375f6d2f5c5b9ff9da3ea9e","kind":"tag","published_at":"2020-01-12T16:50:25.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.6","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.6/manifests"},{"name":"v0.8.5","sha":"5f2ce4da6d30779ab1e6b95a0afac3e0e5595f64","kind":"tag","published_at":"2019-10-29T14:17:29.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.5","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.5/manifests"},{"name":"v0.8.4","sha":"b29ab96557ac5c53e738fcb26f73f631a3f81f1a","kind":"tag","published_at":"2019-01-16T07:26:54.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.4","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.4/manifests"},{"name":"v0.8.3","sha":"f8bcdab2dc0ecd94f35ff9657a263028b96f0c46","kind":"tag","published_at":"2018-04-11T15:03:29.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.3","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.3/manifests"},{"name":"v0.8.2","sha":"9cdef7252f30076992c952e0eff84e66ef9233b5","kind":"tag","published_at":"2018-04-06T08:12:24.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.2","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.2/manifests"},{"name":"v0.8.1","sha":"92deba861d5a1320584450cfa61622a2969b00ef","kind":"tag","published_at":"2018-01-05T15:30:56.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.1","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.1/manifests"},{"name":"v0.8.0","sha":"0410c94463bdae4bdf34d60bff91e9e1eb4a6652","kind":"tag","published_at":"2017-12-12T13:18:58.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.8.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.8.0/manifests"},{"name":"v0.7.4","sha":"6646135c01097b5316d2cb47bc12e541bf26efae","kind":"tag","published_at":"2017-08-16T15:25:28.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.7.4","html_url":"https://github.com/reactphp/http/releases/tag/v0.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.4/manifests"},{"name":"v0.7.3","sha":"ea09c02677279e3211af4d20ee74794461227e16","kind":"tag","published_at":"2017-08-14T08:14:31.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.7.3","html_url":"https://github.com/reactphp/http/releases/tag/v0.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.3/manifests"},{"name":"v0.7.2","sha":"32f0eb3d445b1871b2ba859480ee1981977598f4","kind":"tag","published_at":"2017-07-04T13:15:55.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.7.2","html_url":"https://github.com/reactphp/http/releases/tag/v0.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.2/manifests"},{"name":"v0.7.1","sha":"0be1fc8b03d3305e18950071a088b55c4418f4df","kind":"tag","published_at":"2017-06-17T15:49:47.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.7.1","html_url":"https://github.com/reactphp/http/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.1/manifests"},{"name":"v0.7.0","sha":"8c806074b6637cfd6cbb7049d5d500b18bb56cd4","kind":"tag","published_at":"2017-05-29T15:41:33.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.7.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"b5e7d9bfc9effe8ec723af942c66df042ad17fe6","kind":"tag","published_at":"2017-03-09T14:04:02.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.6.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.6.0/manifests"},{"name":"v0.5.0","sha":"3f4821c3021ac7e5a404edb5d371c3d2fdeb38b7","kind":"tag","published_at":"2017-02-16T15:01:06.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.5.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.5.0/manifests"},{"name":"v0.4.4","sha":"aac319bd789cbc7b478d42cde2d03596e97e3222","kind":"tag","published_at":"2017-02-13T14:14:16.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.4.4","html_url":"https://github.com/reactphp/http/releases/tag/v0.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.4/manifests"},{"name":"v0.4.3","sha":"04794ae226acad33e30af31fae8163b72f041f22","kind":"tag","published_at":"2017-02-10T11:36:22.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.4.3","html_url":"https://github.com/reactphp/http/releases/tag/v0.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.3/manifests"},{"name":"v0.4.2","sha":"abedac54967d7ea237ad104cff8274e2c4077cf4","kind":"tag","published_at":"2016-11-09T16:23:31.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.4.2","html_url":"https://github.com/reactphp/http/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"f575989d67b7db0a65f5dd7e431d8f47af6c2f7b","kind":"commit","published_at":"2015-05-21T20:12:09.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.4.1","html_url":"https://github.com/reactphp/http/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"7b9d293b7a3f73acd840a341497e267d8562d637","kind":"commit","published_at":"2014-02-02T01:11:26.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.4.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.4.0/manifests"},{"name":"v0.3.0","sha":"9e131ab600a636bbe93d3553761ad4f29ebcbc9b","kind":"commit","published_at":"2013-02-24T19:01:50.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.3.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.3.0/manifests"},{"name":"v0.2.6","sha":"5e920f734f4065de1582c125b4bf35128279972f","kind":"commit","published_at":"2012-12-26T16:33:04.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.2.6","html_url":"https://github.com/reactphp/http/releases/tag/v0.2.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.2.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.6/manifests"},{"name":"v0.2.3","sha":"6d2b06f182007da76df13f707b5b6dcc65fa0e30","kind":"commit","published_at":"2012-11-10T20:17:27.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.2.3","html_url":"https://github.com/reactphp/http/releases/tag/v0.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.3/manifests"},{"name":"v0.2.2","sha":"43badbc510d416a482fe967eb300137bf7f7f18b","kind":"commit","published_at":"2012-10-28T10:28:35.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.2.2","html_url":"https://github.com/reactphp/http/releases/tag/v0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.2/manifests"},{"name":"v0.2.1","sha":"d41f6566d48c46430a655a82dc36f27fd81599ab","kind":"commit","published_at":"2012-10-02T23:44:18.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.2.1","html_url":"https://github.com/reactphp/http/releases/tag/v0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.1/manifests"},{"name":"v0.2.0","sha":"923d4a7257d7bacf28bf05354780260694329227","kind":"commit","published_at":"2012-09-10T12:56:19.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.2.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.2.0/manifests"},{"name":"v0.1.1","sha":"527487d0a752c62f4e54abac858caacd03139abe","kind":"commit","published_at":"2012-07-12T21:02:32.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.1.1","html_url":"https://github.com/reactphp/http/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"50e7667bf6d679c1d6cc1fe39e708e49df613e84","kind":"commit","published_at":"2012-07-11T15:43:22.000Z","download_url":"https://codeload.github.com/reactphp/http/tar.gz/v0.1.0","html_url":"https://github.com/reactphp/http/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/reactphp/http@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-09-29T16:19:19.684Z","dependent_packages_count":370,"downloads":29080069,"downloads_period":"total","dependent_repos_count":2046,"rankings":{"downloads":0.19379651863734643,"dependent_repos_count":0.19479290176658728,"dependent_packages_count":0.103623845441049,"stargazers_count":0.4443924104551784,"forks_count":0.42850772185862734,"docker_downloads_count":0.31386068571086956,"average":0.27982901397827636},"purl":"pkg:composer/react/http","advisories":[{"uuid":"GSA_kwCzR0hTQS14NDI0LTY0cWgtNWo1NM4AB5Ys","url":"https://github.com/advisories/GHSA-x424-64qh-5j54","title":"react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU","description":"### Summary\n\nA malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\\Http\\Io\\ChunkedDecoder` into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed.\n\nBoth directions are affected. `ChunkedDecoder` decodes chunked **request** bodies for `React\\Http\\HttpServer` and chunked **response** bodies for `React\\Http\\Browser`, so a server can be attacked by a malicious client and a client can be attacked by a malicious or compromised server.\n\n### Details\n\n`ChunkedDecoder::handleData()` loops `while ($this-\u003ebuffer !== '')` and relies on the buffer shrinking each iteration. Two states leave the buffer unchanged while the loop condition stays true.\n\n**Terminal-chunk trailer.** After the terminating `0` chunk, any remaining buffer is treated as trailer data to skip:\n\n```php\n} elseif ($this-\u003echunkSize === 0) {\n    $this-\u003ebuffer = (string)\\substr($this-\u003ebuffer, $positionCrlf);\n}\n```\n\nWhen the trailer holds no CRLF yet, `strpos()` returns `false`, PHP coerces that to `0` in `substr()`, and the buffer is never advanced. Neither the error guard (which requires a non-zero chunk size) nor the wait guard (which requires fewer than two bytes remaining) can fire, so the loop re-enters with identical state.\n\n**Off-by-one after a completed chunk.** Once a non-terminal chunk has been fully transferred, the \"chunk does not end with a CRLF\" error guard requires `strlen($this-\u003ebuffer) \u003e 2` while the wait guard requires `\u003c 2`. Exactly two non-CRLF bytes slip past both, and because the chunk is already complete nothing is consumed on the next iteration.\n\n### PoC\n\nRun the example server from the `reactphp/reactphp` README and send a malformed request. Note the missing trailing `\\r\\n`:\n\n```\nPOST / HTTP/1.1\\r\\nHost: x\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n0\\r\\nab\n```\n\nThe PHP process pegs at 100% CPU and stops answering legitimate requests. A body of `1\\r\\nAAB` triggers the second state.\n\nThe client side is reachable the same way: a `Browser` request to a server that answers with `Transfer-Encoding: chunked` and either malformed body shape hangs the client process.\n\n### Impact\n\nDenial of service. The affected process stops responding entirely and has to be killed.\n\nServers behind a reverse proxy that parses and re-frames HTTP, such as a typical nginx setup, are not affected on the **server** side, because the proxy normalises the request before it reaches PHP. That mitigation does not extend to the **client** side: outbound requests made with `Browser` reach the remote server directly, so an application fetching attacker-influenced URLs is affected regardless of what sits in front of it.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-17T20:32:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54","https://nvd.nist.gov/vuln/detail/CVE-2026-84997","https://github.com/reactphp/http/commit/b6d4688790adf3797071fcf88a3fc4225f30486a","https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2026-84997.yaml","https://github.com/reactphp/http/releases/tag/v1.11.1","https://github.com/advisories/GHSA-x424-64qh-5j54"],"source_kind":"github","identifiers":["GHSA-x424-64qh-5j54","CVE-2026-84997"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-17T21:00:10.062Z","updated_at":"2026-09-25T12:00:22.019Z","epss_percentage":0.00655,"epss_percentile":0.49172,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NDI0LTY0cWgtNWo1NM4AB5Ys","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14NDI0LTY0cWgtNWo1NM4AB5Ys","packages":[{"ecosystem":"packagist","package_name":"react/http","versions":[{"first_patched_version":"1.11.1","vulnerable_version_range":"\u003e= 0.6.0, \u003c= 1.11.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NDI0LTY0cWgtNWo1NM4AB5Ys/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05NXg0LWo3dmMtaDhtZs4AAzYH","url":"https://github.com/advisories/GHSA-95x4-j7vc-h8mf","title":"ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits","description":"### Summary\n\nPrevious versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the  `RequestBodyBufferMiddleware` with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests.\n\n### Patches\n\nThe supplied patch resolves this vulnerability for ReactPHP.\n\n### Workarounds\n\n- Keeping the request body limit using `RequestBodyBufferMiddleware` sensible will mitigate it.\n\n- Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.\n\n### References\n\nA similar vulnerability was discovered in PHP recently, see also [PHP's security advisory](https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv) (CVE-2023-0662). The fix is based on the [PHP-FPM fix](https://github.com/php/php-src/commit/716de0cff539f46294ef70fe75d548cd66766370#diff-81d659aa9e83177ac08151f99cebf21ab331d22462c72a1039f59947e66f5a35).\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-05-17T17:07:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv","https://github.com/reactphp/http/security/advisories/GHSA-95x4-j7vc-h8mf","https://github.com/php/php-src/commit/716de0cff539f46294ef70fe75d548cd66766370#diff-81d659aa9e83177ac08151f99cebf21ab331d22462c72a1039f59947e66f5a35","https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfd","https://github.com/reactphp/http/releases/tag/v1.9.0","https://nvd.nist.gov/vuln/detail/CVE-2023-26044","https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2023-26044.yaml","https://github.com/advisories/GHSA-95x4-j7vc-h8mf"],"source_kind":"github","identifiers":["GHSA-95x4-j7vc-h8mf","CVE-2023-26044"],"repository_url":"https://github.com/php/php-src","blast_radius":0.0,"created_at":"2023-05-17T18:03:24.862Z","updated_at":"2026-09-30T07:13:10.790Z","epss_percentage":0.0068,"epss_percentile":0.50259,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NXg0LWo3dmMtaDhtZs4AAzYH","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05NXg0LWo3dmMtaDhtZs4AAzYH","packages":[{"ecosystem":"packagist","package_name":"react/http","versions":[{"first_patched_version":"1.9.0","vulnerable_version_range":"\u003e= 0.8.0, \u003c 1.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NXg0LWo3dmMtaDhtZs4AAzYH/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13M3c5LXZyZjUtOG14OM4AAu1p","url":"https://github.com/advisories/GHSA-w3w9-vrf5-8mx8","title":"ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent","description":"### Impact\n\nIn ReactPHP's HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information. \n\n### Patches\n\n* https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 - Fixed in [reactphp/http `v1.7.0`](https://github.com/reactphp/http/releases/tag/v1.7.0)\n\n### Workarounds\n\nInfrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.\n\n### References\n\n* CVE-2020-7070, https://bugs.php.net/bug.php?id=79699 and https://github.com/php/php-src/commit/6559fe912661ca5ce5f0eeeb591d928451428ed0\n* CVE-2020-8184, https://hackerone.com/reports/895727 and https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c\n* Originally introduced via https://github.com/reactphp/http/pull/175\n\n### Credits\n\n* Thanks to Marco Squarcina (TU Wien) for reporting this and working with us to coordinate this security advisory\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Join the discussion](https://github.com/orgs/reactphp/discussions/465)\n* Email us at support@reactphp.org\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-09-16T18:48:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8","https://nvd.nist.gov/vuln/detail/CVE-2022-36032","https://github.com/reactphp/http/pull/175","https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6","https://github.com/reactphp/http/releases/tag/v1.7.0","https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2022-36032.yaml","https://github.com/advisories/GHSA-w3w9-vrf5-8mx8"],"source_kind":"github","identifiers":["GHSA-w3w9-vrf5-8mx8","CVE-2022-36032"],"repository_url":"https://github.com/reactphp/http","blast_radius":0.0,"created_at":"2022-12-21T16:11:58.766Z","updated_at":"2026-09-30T07:14:28.618Z","epss_percentage":0.01025,"epss_percentile":0.62118,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13M3c5LXZyZjUtOG14OM4AAu1p","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13M3c5LXZyZjUtOG14OM4AAu1p","packages":[{"ecosystem":"packagist","package_name":"react/http","versions":[{"first_patched_version":"1.7.0","vulnerable_version_range":"\u003e= 0.7.0, \u003c 1.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13M3c5LXZyZjUtOG14OM4AAu1p/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/packagist/react/http","docker_dependents_count":59,"docker_downloads_count":1687404,"usage_url":"https://repos.ecosyste.ms/usage/packagist/react/http","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/packagist/react/http/dependencies","status":null,"funding_links":["https://opencollective.com/reactphp","https://github.com/sponsors/reactphp","https://github.com/sponsors/clue","https://github.com/sponsors/WyriHaximus"],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-28T15:23:15.293Z","issues_count":57,"pull_requests_count":124,"avg_time_to_close_issue":15110829.43478261,"avg_time_to_close_pull_request":9143459.336363636,"issues_closed_count":46,"pull_requests_closed_count":110,"pull_request_authors_count":28,"issue_authors_count":36,"avg_comments_per_issue":4.087719298245614,"avg_comments_per_pull_request":1.6693548387096775,"merged_pull_requests_count":82,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":1,"past_year_pull_requests_count":5,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":13756871.0,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":4,"past_year_pull_request_authors_count":1,"past_year_issue_authors_count":1,"past_year_avg_comments_per_issue":0.0,"past_year_avg_comments_per_pull_request":1.6,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":4,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/reactphp%2Fhttp/issues","maintainers":[{"login":"clue","count":66,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/clue"},{"login":"WyriHaximus","count":25,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/WyriHaximus"},{"login":"SimonFrings","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/SimonFrings"}],"active_maintainers":[{"login":"WyriHaximus","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/WyriHaximus"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/react%2Fhttp/codemeta","maintainers":[{"uuid":"WyriHaximus","login":"WyriHaximus","name":null,"email":null,"url":null,"packages_count":414,"html_url":"https://packagist.org/users/WyriHaximus","role":null,"created_at":"2022-11-10T10:43:02.224Z","updated_at":"2022-11-10T10:43:02.224Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/WyriHaximus/packages"},{"uuid":"cboden","login":"cboden","name":null,"email":null,"url":null,"packages_count":29,"html_url":"https://packagist.org/users/cboden","role":null,"created_at":"2022-11-10T10:43:02.221Z","updated_at":"2022-11-10T10:43:02.221Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/cboden/packages"},{"uuid":"clue","login":"clue","name":null,"email":null,"url":null,"packages_count":94,"html_url":"https://packagist.org/users/clue","role":null,"created_at":"2022-11-10T10:43:02.228Z","updated_at":"2022-11-10T10:43:02.228Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/clue/packages"},{"uuid":"igorw","login":"igorw","name":null,"email":null,"url":null,"packages_count":51,"html_url":"https://packagist.org/users/igorw","role":null,"created_at":"2022-11-10T10:43:02.215Z","updated_at":"2022-11-10T10:43:02.215Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/igorw/packages"},{"uuid":"jsor","login":"jsor","name":null,"email":null,"url":null,"packages_count":58,"html_url":"https://packagist.org/users/jsor","role":null,"created_at":"2022-11-10T10:43:02.212Z","updated_at":"2022-11-10T10:43:02.212Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/jsor/packages"}]}