[fabianbloching]

Updates

• Affected products

Comments
The vulnerable code is in src/Serializer/AbstractItemNormalizer.php, which API Platform also ships as the standalone split package api-platform/serializer. Applications that install the split packages (api-platform/symfony, api-platform/graphql, api-platform/doctrine-orm, …) instead of api-platform/core get the vulnerable class from api-platform/serializer and are not flagged by composer audit or Dependabot, because this advisory lists api-platform/core only and Composer matches advisories by installed package name.

• The fix commit api-platform/core@6bcbeb2 changes src/Serializer/AbstractItemNormalizer.php (the is_a type-confusion guard) and raises the api-platform/serializer requirement in the split packages' composer.json.
• Split tags on https://github.com/api-platform/serializer: AbstractItemNormalizer.php contains the guard ("does not reference the correct resource") in v4.1.30, v4.2.26 and v4.3.12, and does not contain it in v4.1.29, v4.2.25 and v4.3.11. The split package shares the monorepo's version tags.
• Precedent in the same advisory set: GHSA-pjhx-3c3w-9v23 lists the split packages api-platform/json-api and api-platform/hal next to api-platform/core.
• Packagist currently returns no advisory for api-platform/serializer (https://packagist.org/api/security-advisories/?packages[]=api-platform/serializer), so composer audit on an installation with api-platform/serializer 4.3.5 reports nothing.

introduced: 0 mirrors the existing api-platform/core entry.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the advisory update adding coverage for api-platform/serializer.

No open issues 🎉

What changed in this PR

Extends the API Platform type-confusion advisory to cover api-platform/serializer, enabling security tooling to identify affected installations that use the standalone package rather than api-platform/core.

Changes:

• Adds api-platform/serializer as an affected Packagist package.
• Defines affected ranges with fixes at versions 4.1.30, 4.2.26, and 4.3.12.

File	Description
advisories/​github-reviewed/​2026/​08/​GHSA-9rjg-x2p2-h68h/​GHSA-9rjg-x2p2-h68h.json	Adds the serializer package and its affected version ranges to the advisory.

_{Review effort: Max (auto)}