Packagist/zumba/json-serializer CVE-2026-27206: high 8.1, EPSS 1.17%

Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Action: Upgrade zumba/json-serializer to 3.2.3 or later.

composer require zumba/json-serializer:3.2.3

Affected

Fixed versions

Sources

• osv: GHSA-v7m3-fpcr-h7m2
• https://github.com/zumba/json-serializer/security/advisories/GHSA-v7m3-fpcr-h7m2
• https://nvd.nist.gov/vuln/detail/CVE-2026-27206
• https://github.com/zumba/json-serializer/commit/bf26227879adefce75eb9651040d8982be97b881
• https://github.com/zumba/json-serializer
• https://github.com/zumba/json-serializer/releases/tag/3.2.3

CVE-2026-27206 · published 2026-02-19T22:05:40Z · modified 2026-02-23T23:43:50.512291Z · JSON