--- title: Symfony 5.4.55 released (Symfony Blog) | daily.dev description: Symfony 5.4.55 has been released with a security fix and several bug fixes. The Mime component now rejects parameter names containing non-token characters,... canonical: https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Symfony 5.4.55 released (Symfony Blog) | daily.dev og:description: Symfony 5.4.55 has been released with a security fix and several bug fixes. The Mime component now rejects parameter names containing non-token characters,... og:url: https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9 og:image: https://api.daily.dev/og/posts/HCe5aUvY9.png og:image:alt: Symfony 5.4.55 released (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Symfony 5.4.55 released (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 1 min read · 0 upvotes · 0 comments ## Summary Symfony 5.4.55 has been released with a security fix and several bug fixes. The Mime component now rejects parameter names containing non-token characters, addressing CVE-2026-45070. Two other Mime fixes escape backslashes in Address::getEncodedName() and escape quotes and backslashes in quoted parameter values. The Serializer component now escapes formulas in the header row of CSV files, and WebProfilerBundle checks that the profiler is enabled before opening files. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does CVE-2026-45070 fix in Symfony's Mime component? CVE-2026-45070, fixed in Symfony 5.4.55, addresses the Mime component accepting parameter names with non-token characters. The fix rejects such parameter names outright. The same release also escapes backslashes in Address::getEncodedName() and escapes quotes and backslashes in quoted parameter values within Mime. _Teams running Symfony 5.4 track security patches like this on daily.dev before they fall behind._ ### What changed in Symfony's Serializer CSV export in version 5.4.55? Symfony 5.4.55 updates the Serializer component to escape formulas in the header row of CSV files, closing a CSV injection risk where formula-like values could execute when opened in spreadsheet software. This was shipped as a bug fix alongside other Mime and WebProfilerBundle patches in the same release. _Developers exporting CSV data with Symfony keep up with fixes like this via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Symfony 5.4.55 released (Symfony Blog)","url":"https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9"},"datePublished":"2026-10-28T18:25:50.573Z","dateModified":"2026-10-28T18:42:43.651Z","description":"Symfony 5.4.55 has been released with a security fix and several bug fixes. The Mime component now rejects parameter names containing non-token characters,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,symfony","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"Symfony 5.4.55 released (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/symfony-5-4-55-released-symfony-blog--hce5auvy9#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-45070 fix in Symfony's Mime component?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-45070, fixed in Symfony 5.4.55, addresses the Mime component accepting parameter names with non-token characters. The fix rejects such parameter names outright. The same release also escapes backslashes in Address::getEncodedName() and escapes quotes and backslashes in quoted parameter values within Mime. Teams running Symfony 5.4 track security patches like this on daily.dev before they fall behind."}},{"@type":"Question","name":"What changed in Symfony's Serializer CSV export in version 5.4.55?","acceptedAnswer":{"@type":"Answer","text":"Symfony 5.4.55 updates the Serializer component to escape formulas in the header row of CSV files, closing a CSV injection risk where formula-like values could execute when opened in spreadsheet software. This was shipped as a bug fix alongside other Mime and WebProfilerBundle patches in the same release. Developers exporting CSV data with Symfony keep up with fixes like this via daily.dev."}}]} ```