Tiptap contains an input validation vulnerability resulting in DoS
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ueberdosis/tiptap-php | < 2.1.1 | 2.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-47110
- https://github.com/ueberdosis/tiptap-php/pull/94
- https://github.com/ueberdosis/tiptap-php/commit/74bfb7be1c8c6102b240f3879b7f984a6ab87b97
- https://github.com/ueberdosis/tiptap-php
- https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1
- https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-241- Platform
- Composer
- Package
ueberdosis/tiptap-php- Disclosed
- 25.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4595-7fjw-r3jh - CC BY 4.0
Vulnerability history: ueberdosis/tiptap-php
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.