Packagist/api-platform/hal CVE-2026-49858: medium 5.9
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Action: Upgrade api-platform/hal to 4.1.29 or later.
composer require api-platform/hal:4.1.29composer require api-platform/hal:4.2.25composer require api-platform/hal:4.3.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.1.29 | - |
| 4.2.0 | 4.2.25 | - |
| 4.3.0 | 4.3.8 | - |
Fixed versions
| 4.1.29 | 4.2.25 | 4.3.8 |
Sources
- osv: GHSA-pjhx-3c3w-9v23#Packagist/api-platform/hal
- https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23
- https://nvd.nist.gov/vuln/detail/CVE-2026-49858
- https://github.com/api-platform/core
CVE-2026-49858 · published · modified · JSON