Symfony published 5.4.54 on 15 October 2026 as a signed security release for the 5.4 branch. Fabien Potencier published the release, whose tag baea8c8 carries GitHub’s verified signature. The changelog compares v5.4.53 with v5.4.54.

Three CVEs receive fixes. ExpressionLanguage now limits the nesting level of parsed expressions. HttpFoundation removes an ambiguity that could make HeaderUtils::split() backtrack. Yaml limits recursion depth in its inline lexer. Related fixes cap the depth of parsed expression trees, handle chained ternaries, and return a controlled error when !!binary receives an unparsable value.

HttpClient no longer repeats query options on redirects handled by NoPrivateNetworkHttpClient. It accepts highly compressed responses while rejecting decompression bombs. The client now covers additional non-routable ranges, rejects HTTPS proxies that curl would contact in cleartext, and removes the original Host header when a redirect changes authority. Credentials are dropped when a redirect changes scheme, and 3xx pushed responses are rejected.

HttpFoundation validates forwarded IPv4-mapped IPv6 ports and URL hosts or schemes. It rejects invalid paths, reserved cookie characters, and unsafe X-Sendfile-Type values. Paths in X-Accel-Redirect are encoded, trusted host patterns are combined to avoid PCRE limits, and session handlers are no longer serializable. Mime rejects invalid header names, raw control characters, and malformed email addresses. Process uses an absolute Windows cmd.exe fallback, filters invalid environment values, and stops CGI or FastCGI request variables from reaching subprocesses.

Security handling no longer logs session tokens. Malformed remember-me cookies and login-link parameters are handled safely. Legacy nested unserialize() calls were removed from token and exception classes. Session-disabled redirects stay on the current host, selected unserialize() calls use allowed_classes => false, and profiler tokens are validated before becoming file names. Login throttling uses a lock by default, while a race affecting login-link max_uses is narrowed.

Messenger validates stamps on decoded and unserialized envelopes, restricts X-Message-Stamp-* headers, and removes trace arguments from FlattenException normalization. Serializer cache keys now work with non-serializable contexts, and MetadataAwareNameConverter caches are scoped per instance. MimeMessageNormalizer checks that the denormalized class is a Mime part.

The release also fixes session identifiers retained by PHP, UriSigner handling of non-string hash values, Routing matches for the "0" URL, Redis lock tokens using the reserved "write" member, and UTF-8 C1 escaping in VarDumper. RateLimiter caps burst size and derived duration. Cache avoids unmarshalling data that SodiumMarshaller cannot decrypt, and HttpKernel strips cache-internal headers from backend responses. The release declares the polyfills required by code running on PHP 7.2, preserves source modes during file copies, keeps suffixed tempnam() files private, and escapes terminal context strings in Console, MonologBridge, and VarDumper.