Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

laminas/laminas-diactoros

              3.9.x @ 6b8a38d
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

HTTP Header Injection: 2 prior fixes. Scrutinize any change in this area.

src/HeaderSecurity.php: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Header Injection: Two separate fixes in the same component show repeated CRLF/newline injection in header names and values, indicating a historically weak validation point.

HTTP Header Injection: Header validation in the request initialization path was missing, allowing CRLF injection via header names or values—a sibling path to HeaderSecurity that needed its own fix.

Spoofing / Header Injection: Trusting X-Forwarded-* headers by default allows remote attackers to spoof the request URI, a distinct attack surface from direct header injection.