-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laminas/laminas-diactoros | composer | < 2.18.1 | 2.18.1 |
| laminas/laminas-diactoros | composer | = 2.19.0 | 2.19.1 |
| laminas/laminas-diactoros | composer | = 2.20.0 | 2.20.1 |
| laminas/laminas-diactoros | composer | = 2.21.0 | 2.21.1 |
| laminas/laminas-diactoros | composer | = 2.22.0 | 2.22.1 |
| laminas/laminas-diactoros | composer | = 2.23.0 | 2.23.1 |
| laminas/laminas-diactoros | composer | >= 2.24.0, < 2.24.2 | 2.24.2 |
| laminas/laminas-diactoros | composer | >= 2.25.0, < 2.25.2 | 2.25.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper header name validation. The commit diff shows the critical fix was adding the 'D' modifier to the regex in HeaderSecurity::assertValidName() to enforce strict start/end matching. This function is directly responsible for validating header names, and the pre-patch regex allowed trailing newlines. The tests added in HeaderSecurityTest.php verify rejection of names with newlines, confirming this function's role in the vulnerability.
PHPPHPOngoing coverage of React2Shell