api-platform/hal

API Platform HAL component

View on Packagist

View on Github

Activity

Latest release: 9h ago
Total releases: 34
Cadence: ~2 days
Last 12 months: 33

Reach

Stars: 3

Details

License: MIT
First release: Sep 16, 2025

Releases

Version	Released
`v5.0.0-beta.2` pre	Sep 15, 2026
`v5.0.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.3` pre	Sep 12, 2026
`v4.4.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.2` pre	Sep 12, 2026
`v5.0.0-alpha.3` pre	Jul 12, 2026
`v5.0.0-alpha.2` pre	Jul 12, 2026
`v4.4.0-alpha.4` pre	Jul 12, 2026
`v4.4.0-alpha.3` pre	Jul 12, 2026
`v4.3.19` patch	Jul 03, 2026
`v4.3.18` patch	Jul 03, 2026
`v4.3.17` patch	Jul 03, 2026
`v5.0.0-alpha.1` pre	Jun 29, 2026
`v4.4.0-alpha.2` pre	Jun 25, 2026
`v4.4.0-alpha.1` pre	Jun 13, 2026
`v4.3.15` patch	Jun 13, 2026
`v4.2.26` patch	Jun 13, 2026
`v4.3.11` patch	Jun 04, 2026
`v4.3.8` patch	Jun 04, 2026
`v4.2.25` patch	Jun 04, 2026
`v4.3.7` patch 1 CVE	May 11, 2026
`v4.3.4` patch 1 CVE	Apr 30, 2026
`v4.3.3` minor 1 CVE	Mar 06, 2026
`v4.3.0-beta.2` pre	Mar 06, 2026
`v4.3.0-beta.1` pre	Feb 27, 2026
`v4.2.24` patch 1 CVE	Feb 25, 2026
`v4.3.0-alpha.2` pre	Feb 13, 2026
`v4.2.17` patch 1 CVE	Feb 13, 2026
`v4.2.15` patch 1 CVE	Jan 26, 2026
`v4.2.14` patch 1 CVE	Dec 27, 2025
`v4.2.11` patch 1 CVE	Nov 30, 2025
`v4.2.7` patch 1 CVE	Nov 30, 2025
`v4.2.6` patch 1 CVE	Nov 13, 2025
`v4.2.3` initial 1 CVE	Sep 16, 2025

Repository

api-platform/hal

Forks: 0
Open issues: 0
Language: PHP

Dependencies (5)

Depends on

v5.0.0-beta.2

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-49858 GHSA-pjhx-3c3w-9v23 Jul 10, 2026

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

5.9 / 10
Medium
Network High None None Unchanged High None None

Impact

#[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.

This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL ItemNormalizer. The JSON:API and HAL paths were not addressed at the time.

Exploitation conditions

Exploitation requires all of the following to coincide:

The application exposes a resource via the JSON:API and/or HAL formats.

At least one property of that resource uses #[ApiProperty(security: ...)] with a predicate whose result depends on the current user (or on per-request state).

A request from a user for whom the predicate evaluates to true populates componentsCache before a request from a user for whom the predicate evaluates to false, within the lifetime of the same PHP process.

The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic php-fpm workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.

Patches

4.1.29

4.2.25

4.3.8

All three branches receive patched releases of api-platform/core, api-platform/json-api, and api-platform/hal.

Workarounds

Override the JSON:API and HAL ItemNormalizer services to gate $context['cache_key'] with a resource-class security check, or avoid #[ApiProperty(security: ...)] on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic php-fpm workers also limits exposure since the cache does not survive across requests.

Credits

Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving isCacheKeySafe to AbstractItemNormalizer.

Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.

Affected versions

v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.15v4.2.16v4.2.17v4.2.18v4.2.19v4.2.20v4.2.21

+ 18 more Show less

v4.2.22v4.2.23v4.2.24v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7

Fixed in

4.1.294.2.254.3.8

References

https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23
https://nvd.nist.gov/vuln/detail/CVE-2026-49858
https://github.com/api-platform/core

Updated Jul 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 1
patch 17
pre 15

34 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More