.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

guzzlehttp/guzzle 7.12.1 vulnerabilities

14 advisories known · guzzlehttp/guzzle@7.12.1 · 7 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 7.12.1

SEVERITYADVISORYPUBLISHED

HighGuzzle: Noncanonical host can bypass host-based checksGHSA-v5mv-p594-2x33CVE-2026-69246Affected <7.15.2, >=8.0.0 <8.0.1Fixed in 7.15.2 Fixed in 8.0.1OSV source ↗3 months ago

MediumGuzzle: Noncanonical cookie domain keeps subdomain scopeGHSA-f7vp-7xgx-4w4rCVE-2026-69245Affected <7.15.2, >=8.0.0 <8.0.1Fixed in 7.15.2 Fixed in 8.0.1OSV source ↗3 months ago

MediumGuzzle: URI fragments disclosed in redirect Referer headersGHSA-h95v-h523-3mw8CVE-2026-67354Affected <7.15.1Fixed in 7.15.1OSV source ↗4 months ago

MediumGuzzle: Host-only cookie scope is not preservedGHSA-wm3w-8rrp-j577CVE-2026-67355Affected <7.15.1Fixed in 7.15.1OSV source ↗4 months ago

MediumGuzzle: Unbounded response cookies risk denial of serviceGHSA-f283-ghqc-fg79CVE-2026-67353Affected <7.15.1Fixed in 7.15.1OSV source ↗4 months ago

MediumGuzzle: Proxy-Authorization headers can be sent to origin serversGHSA-94pj-82f3-465wCVE-2026-67339Affected <7.14.2Fixed in 7.14.2OSV source ↗4 months ago

MediumGuzzle: Cookie Disclosure and Injection via IP-Address DomainsGHSA-g446-98w2-8p5wCVE-2026-59883Affected <7.12.3Fixed in 7.12.3OSV source ↗4 months ago

Does not affect 7.12.1

SEVERITYADVISORYPUBLISHED

HighHTTP Proxy header vulnerabilityGHSA-m6ch-gg5f-wxx3CVE-2016-5385Affected >=4.0.0-rc2 <4.2.4, >=5 <5.3.1, >=6 <6.2.1Fixed in 4.2.4 Fixed in 5.3.1 Fixed in 6.2.1OSV source ↗5 years ago

HighCross-domain cookie leakage in GuzzleGHSA-cwmx-hcrq-mhc3BIT-drupal-2022-29248CVE-2022-29248DRUPAL-CORE-2022-010Affected <6.5.6, >=7.0.0 <7.4.3Fixed in 6.5.6 Fixed in 7.4.3OSV source ↗4 years ago

HighChange in port should be considered a change in originGHSA-q559-8m2m-g699CVE-2022-31091Affected <6.5.8, >=7.0.0 <7.4.5Fixed in 6.5.8 Fixed in 7.4.5OSV source ↗4 years ago

HighCURLOPT_HTTPAUTH option not cleared on change of originGHSA-25mq-v84q-4j7rCVE-2022-31090Affected <6.5.8, >=7.0.0 <7.4.5Fixed in 6.5.8 Fixed in 7.4.5OSV source ↗4 years ago

HighFailure to strip the Cookie header on change in host or HTTP downgradeGHSA-f2wf-25xc-69c9BIT-drupal-2022-31042BIT-drupal-2022-31043CVE-2022-31042CVE-2022-31043DRUPAL-CORE-2022-011GHSA-w248-ffj2-4v5qAffected >=4.0.0 <6.5.7, >=7.0.0 <7.4.4Fixed in 6.5.7 Fixed in 7.4.4OSV source ↗4 years ago

Mediumguzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to CleartextGHSA-wpwq-4j6v-78m3CVE-2026-55568Affected <7.12.1Fixed in 7.12.1OSV source ↗5 months ago

Mediumguzzlehttp/guzzle: Dot-Only Cookie Domains Match All HostsGHSA-cwxw-98qj-8qjxCVE-2026-55767Affected <7.12.1Fixed in 7.12.1OSV source ↗5 months ago