api-platform/json-api

[READ ONLY] API Platform JSON:API component

View on Packagist

View on Github

Activity

Latest release: 8h ago
Total releases: 76
Cadence: ~3 days
Last 12 months: 42

Reach

Stars: 4

Details

License: MIT
First release: Jun 25, 2024

Releases

Version	Released
`v5.0.0-beta.2` pre	Sep 15, 2026
`v5.0.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.3` pre	Sep 12, 2026
`v4.4.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.2` pre	Sep 12, 2026
`v5.0.0-alpha.3` pre	Sep 04, 2026
`v4.4.0-alpha.4` pre	Sep 04, 2026
`v5.0.0-alpha.2` pre	Jul 12, 2026
`v4.4.0-alpha.3` pre	Jul 12, 2026
`v5.0.0-alpha.1` pre	Jun 29, 2026
`v4.4.0-alpha.2` pre	Jun 25, 2026
`v4.4.0-alpha.1` pre	Jun 23, 2026
`v4.3.19` patch	Jun 17, 2026
`v4.3.18` patch	Jun 17, 2026
`v4.3.17` patch	Jun 17, 2026
`v4.3.13` patch	Jun 13, 2026
`v4.2.26` patch	Jun 13, 2026
`v4.1.30` patch	Jun 13, 2026
`v4.3.11` patch	Jun 05, 2026
`v4.3.9` patch	Jun 04, 2026
`v4.3.8` patch	Jun 04, 2026
`v4.2.25` patch	Jun 04, 2026
`v4.1.29` patch	May 27, 2026
`v4.3.7` patch 1 CVE	May 25, 2026
`v4.3.6` patch 1 CVE	May 22, 2026
`v4.3.5` patch 1 CVE	Apr 30, 2026
`v4.3.3` minor 1 CVE	Mar 13, 2026
`v4.2.24` patch 1 CVE	Mar 13, 2026
`v4.3.0-beta.2` pre	Mar 06, 2026
`v4.3.0-beta.1` pre	Mar 03, 2026
`v4.2.20` patch 1 CVE	Feb 27, 2026
`v4.3.0-alpha.2` pre	Feb 13, 2026
`v4.2.18` patch 1 CVE	Feb 13, 2026
`v4.2.15` patch 1 CVE	Jan 26, 2026
`v4.2.14` patch 1 CVE	Dec 27, 2025
`v4.2.11` patch 1 CVE	Dec 19, 2025
`v4.2.10` patch 1 CVE	Dec 04, 2025
`v4.2.8` patch 1 CVE	Nov 30, 2025
`v4.2.7` patch 1 CVE	Nov 30, 2025
`v4.2.6` patch 1 CVE	Nov 13, 2025
`v4.1.28` patch 1 CVE	Nov 13, 2025
`v4.2.4` patch 1 CVE	Nov 13, 2025
`v4.2.3` minor 1 CVE	Sep 16, 2025
`v4.1.26` patch 1 CVE	Sep 15, 2025
`v4.2.0-alpha.3` pre	Aug 19, 2025
`v4.1.23` patch 1 CVE	Aug 06, 2025
`v4.2.0-alpha.1` pre	Jun 30, 2025
`v4.1.20` patch 1 CVE	Jun 06, 2025
`4.1.14` patch 1 CVE	Jun 06, 2025
`v4.1.12` patch 1 CVE	May 22, 2025

1–50 of 76

Repository

api-platform/json-api

Forks: 0
Open issues: 0
Language: PHP

api-platform
json-api
php
rest

Dependencies (8)

Depends on

v5.0.0-beta.2

Used by

Supply-chain exposure

5 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-49858 GHSA-pjhx-3c3w-9v23 Jul 10, 2026

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

5.9 / 10
Medium
Network High None None Unchanged High None None

Impact

#[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.

This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL ItemNormalizer. The JSON:API and HAL paths were not addressed at the time.

Exploitation conditions

Exploitation requires all of the following to coincide:

The application exposes a resource via the JSON:API and/or HAL formats.

At least one property of that resource uses #[ApiProperty(security: ...)] with a predicate whose result depends on the current user (or on per-request state).

A request from a user for whom the predicate evaluates to true populates componentsCache before a request from a user for whom the predicate evaluates to false, within the lifetime of the same PHP process.

The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic php-fpm workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.

Patches

4.1.29

4.2.25

4.3.8

All three branches receive patched releases of api-platform/core, api-platform/json-api, and api-platform/hal.

Workarounds

Override the JSON:API and HAL ItemNormalizer services to gate $context['cache_key'] with a resource-class security check, or avoid #[ApiProperty(security: ...)] on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic php-fpm workers also limits exposure since the cache does not survive across requests.

Credits

Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving isCacheKeySafe to AbstractItemNormalizer.

Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.

Affected versions

4.1.14v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18

+ 76 more Show less

v4.0.19v4.0.2v4.0.20v4.0.21v4.0.22v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.10v4.1.11v4.1.12v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.15v4.2.16v4.2.17v4.2.18v4.2.19v4.2.2v4.2.20v4.2.21v4.2.22v4.2.23v4.2.24v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7

Fixed in

4.1.294.2.254.3.8

References

https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23
https://nvd.nist.gov/vuln/detail/CVE-2026-49858
https://github.com/api-platform/core

Updated Jul 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 4
patch 43
pre 27

76 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More