guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase

Published as "CRLF injection in HTTP start-line serialization"

medium Guzzle · Last reviewed Nov 7, 2026

CVE: CVE-2026-55766
GHSA: GHSA-vm85-hxw5-5432
Packagist: PKSA-7qs6-zvnz-h66r
Reported: Jun 18, 2026

Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.

Affected and fixed versions

In guzzlehttp/psr7. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
Up to 2.12.0	2.12.1	Supported

Upgrade

Run the line for the branch you are on.

composer require guzzlehttp/psr7:^2.12.1

What this means

guzzlehttp/psr7 didn't reject line breaks in a request's method, its protocol version, or a response's reason phrase. If your app puts untrusted data in one of those and then writes the message out as raw HTTP, an attacker can add header lines of their own.

Depending on what reads that raw message next, this can lead to header injection, response splitting, request smuggling or cache poisoning. See the Guzzle advisory.

Who is affected

Apps that build psr7 messages themselves and serialize them, for example with Message::toString(). That's most likely in proxies, custom transports, crawlers, webhook delivery, testing or replay tools. Parsing an untrusted raw message with Message::parseRequest() or Message::parseResponse() and then serializing it again is affected too.

Sending requests the normal way through Guzzle's HTTP client is not expected to be affected. Creating a Request or Response alone does nothing: the message has to be serialized and then sent, forwarded or processed by software that doesn't reject the malformed first line.

What to do

Update guzzlehttp/psr7 to 2.12.1. Until you can, Guzzle advises rejecting CR and LF characters in untrusted method, protocol version and reason phrase values before building messages. If you parse raw messages, check the raw first line before calling the parse methods. If your app builds requests from $_SERVER values an attacker can influence, check REQUEST_METHOD and SERVER_PROTOCOL before calling ServerRequest::fromGlobals().

Reported by Ilia Alshanetsky.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase (CVE-2026-55766, GHSA-vm85-hxw5-5432)
Details: https://phpnews.net/security/guzzle/ghsa-vm85-hxw5-5432

Affected versions, as Composer constraints:
- guzzlehttp/psr7: <2.12.1

Fixed releases on branches that still get security fixes:
- Up to 2.12.0: update to 2.12.1

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/guzzle/ghsa-vm85-hxw5-5432 and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Guzzle advisories