API Platform v4.4.7 and v5.0.6 are out with 3 security fixes (securityPostDenormalize bypasses, GraphQL mutation flush, attribute cache leak in worker mode), please upgrade!
github.com/api-platform...
github.com/api-platform...
Release v5.0.6 · api-platform/core
What's Changed
fix(graphql): update existing object on nested input id by @soyuka in #8786
fix(jsonapi): declare type: object on JSON:API resource schemas by @ousamabenyounes in #8724
fix(state): ...
github.com
November 6, 2026 at 1:09 PM
API Platform v4.4.7 and v5.0.6 are out with 3 security fixes (securityPostDenormalize bypasses, GraphQL mutation flush, attribute cache leak in worker mode), please upgrade!
github.com/api-platform...
github.com/api-platform...
jsonapi 1.14.4 [updated]
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
November 2, 2026 at 2:30 PM
jsonapi 1.14.4 [updated]
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
Fully functional JSONAPI V1 Serializer as well as a QueryParser for Plug based projects and applications.
Licenses: MIT
🚨 EUVD-2026-107872
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
October 22, 2026 at 3:05 AM
🚨 EUVD-2026-107872
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📊 n/a
🏢 Drupal
📝 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107872
#cybersecurity #infosec #cve #euvd
📦 alexfigures/symfony-jsonapi-bundle v1.0.0
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
October 8, 2026 at 12:36 PM
📦 alexfigures/symfony-jsonapi-bundle v1.0.0
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
JSON:API 1.1 bundle for Symfony with Doctrine and custom persistence
🔗 https://github.com/AlexFigures/jsonapi-symfony
📦 webservco/jsonapi-application v2.0.1
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
October 4, 2026 at 11:34 AM
📦 webservco/jsonapi-application v2.0.1
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
A PHP component/library.
🔗 https://github.com/webservco/jsonapi-application
#Drupal security advisory: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (2026-09-02) #PHP. See https://www.drupal.org/sa-contrib-2026-127
September 2, 2026 at 5:00 PM
#Drupal security advisory: Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (2026-09-02) #PHP. See https://www.drupal.org/sa-contrib-2026-127
📦 serhiikamolov/laravel-jsonapi v4.4.0
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
August 31, 2026 at 7:58 PM
📦 serhiikamolov/laravel-jsonapi v4.4.0
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
I took over a bit of security maintenance for #Drupal entity API module.
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
August 26, 2026 at 6:30 PM
I took over a bit of security maintenance for #Drupal entity API module.
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
If you use it with JSONAPI you should upgrade.
Thanks @berdir for the collaboration 😍
drupal.org/sa-contrib-2026-113…
📦 alsvanzelf/jsonapi v3.0.2
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
August 22, 2026 at 8:01 AM
📦 alsvanzelf/jsonapi v3.0.2
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
Human-friendly library to implement JSON:API without needing to know the specification.
🔗 https://github.com/lode/jsonapi
JSON:API Views 8.x-1.2 fixes cache metadata, route-build performance, preview URLs, numeric bundle routing and OpenAPI discovery. A stable contrib update for decoupled Drupal using Views over JSON:API.
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
August 13, 2026 at 2:34 PM
JSON:API Views 8.x-1.2 fixes cache metadata, route-build performance, preview URLs, numeric bundle routing and OpenAPI discovery. A stable contrib update for decoupled Drupal using Views over JSON:API.
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
##Drupal #JSONAPI #DecoupledDrupal #DrupalViews
https://bit.ly/4zeaoca
nrcmedia har nettopp åpnet repoet nrcmedia/jsonapi-serializer: https://github.com/nrcmedia/jsonapi-serializer
Et rammeverksuavhengig bibliotek for Node.js som brukes til å serialisere data til JSON API
Et rammeverksuavhengig bibliotek for Node.js som brukes til å serialisere data til JSON API
July 7, 2026 at 1:29 PM
nrcmedia har nettopp åpnet repoet nrcmedia/jsonapi-serializer: https://github.com/nrcmedia/jsonapi-serializer
Et rammeverksuavhengig bibliotek for Node.js som brukes til å serialisere data til JSON API
Et rammeverksuavhengig bibliotek for Node.js som brukes til å serialisere data til JSON API
Drupal Security Team published eight advisories on 17 June: five for core, three for contrib.
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
June 18, 2026 at 2:45 PM
Drupal Security Team published eight advisories on 17 June: five for core, three for contrib.
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
Core fixes cover JSON:API, oEmbed, image upload validation, and deserialization risks.
https://bit.ly/4oBXorV
##Drupal #DrupalSecurity #JSONAPI #DrupalCore
F5 Labs reports scanner activity targeting Drupal CVE-2026-9082 after disclosure.
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
F5 Labs Details Drupal CVE-2026-9082 Scanning Patterns
F5 Labs’ Sensor Intel report adds sensor-level evidence to the CVE-2026-9082 response, documenting how scanners probed Drupal JSON:API endpoints after disclosure rather than revisiting the advisory itself. Its useful contribution is the traffic patte...
bit.ly
June 16, 2026 at 2:03 PM
F5 Labs reports scanner activity targeting Drupal CVE-2026-9082 after disclosure.
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
Observed probes focused on JSON:API node endpoints and used blind SQL injection patterns, with defensive advice centred on logs and access review.
https://bit.ly/4gobUS4
##Drupal #Cybersecurity #JSONAPI
DrupalRX’s Darrell Green examines why JSON:API responses can slow down headless Drupal projects.
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
DrupalRX Article Examines JSON:API Performance Issues in Headless Drupal
DrupalRX has published a technical article on common causes of slow JSON:API responses in headless Drupal projects. The post argues that teams should examine payload size, includes, relationship depth, caching, serialization costs, and frontend reque...
bit.ly
June 10, 2026 at 4:48 PM
DrupalRX’s Darrell Green examines why JSON:API responses can slow down headless Drupal projects.
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
The article highlights payload size, broad includes, deep relationships, caching gaps, serialisation work, and frontend request behaviour.
https://bit.ly/4ghQqGm
##JSONAPI #HeadlessDrupal #Performance
📦 aimeos/pagible-jsonapi 0.11.1
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
June 5, 2026 at 6:31 PM
📦 aimeos/pagible-jsonapi 0.11.1
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
🔒 API Platform CVE-2026-49858: JSON:API & HAL normalizers cached components across users on long-running runtimes (FrankenPHP, RoadRunner, Swoole).
Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now.
github.com/api-platform...
Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now.
github.com/api-platform...
Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
### Impact
`#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in `ApiPlatform\JsonApi\Serializer\ItemNormalizer` and `Ap...
github.com
June 4, 2026 at 12:08 PM
🔒 API Platform CVE-2026-49858: JSON:API & HAL normalizers cached components across users on long-running runtimes (FrankenPHP, RoadRunner, Swoole).
Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now.
github.com/api-platform...
Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now.
github.com/api-platform...
📦 serhiikamolov/laravel-jsonapi v4.2.1
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
May 31, 2026 at 6:18 PM
📦 serhiikamolov/laravel-jsonapi v4.2.1
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
📦 serhiikamolov/laravel-jsonapi v4.3.1
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
May 31, 2026 at 6:17 PM
📦 serhiikamolov/laravel-jsonapi v4.3.1
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
A set of interfaces and classes to facilitate the construction of an efficient Json Api application with the Laravel framework.
🔗 https://github.com/serhiikamolov/laravel-jsonapi
🚨 In this week’s newsletter, we cover CVE-2026-9082, a Drupal JSON: API SQL injection vulnerability now under active exploitation.
We break down how attackers are targeting exposed /jsonapi/ endpoints and what defenders should do next.
👉 www.crowdsec.net/vulntracking...
We break down how attackers are targeting exposed /jsonapi/ endpoints and what defenders should do next.
👉 www.crowdsec.net/vulntracking...
May 25, 2026 at 12:44 PM
🚨 In this week’s newsletter, we cover CVE-2026-9082, a Drupal JSON: API SQL injection vulnerability now under active exploitation.
We break down how attackers are targeting exposed /jsonapi/ endpoints and what defenders should do next.
👉 www.crowdsec.net/vulntracking...
We break down how attackers are targeting exposed /jsonapi/ endpoints and what defenders should do next.
👉 www.crowdsec.net/vulntracking...
Where do you stand on jsonapi these days?
May 18, 2026 at 8:50 PM
Where do you stand on jsonapi these days?
May 7, 2026 at 1:00 PM
📦 aimeos/pagible-jsonapi 0.10.2
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
April 26, 2026 at 8:20 AM
📦 aimeos/pagible-jsonapi 0.10.2
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
Pagible CMS - JSON:API server
🔗 https://github.com/aimeos/pagible-jsonapi
Drupal Canvas currently limits Views to block-only integration with minimal configuration. A workaround using HTMX + JSON:API restores dynamic behavior.
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Drupal Canvas Views Limitations and Workaround with HTMX Explained
A blog post shows how developers handle dynamic content in Drupal Canvas using HTMX and code components due to current Views limitations.
bit.ly
April 24, 2026 at 1:26 PM
Drupal Canvas currently limits Views to block-only integration with minimal configuration. A workaround using HTMX + JSON:API restores dynamic behavior.
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI
Read more: https://bit.ly/3Qt3ONb
##Drupal #DrupalCanvas #HTMX #JSONAPI