Drupal Releases Three Core Patches With Symfony Security Fixes

Following upstream Symfony security advisories, Drupal released three production-ready core patches on 6 November 2026. The releases, 11.4.12, 11.3.21 and 10.6.21, incorporate security-related dependency updates alongside other maintenance corrections. Drupal.org classifies all three as bug-fix releases rather than new Drupal core security advisories.

The patches provide Drupal sites with updated core packages following the upstream Symfony security disclosures covered by The DropTimes on 6 November. The dependency updates differ between Drupal 10 and Drupal 11, making the installed core version and Composer configuration relevant to each site's update process.

Drupal 11.4.12 and 11.3.21 update selected Symfony components to version 7.4.23, while Drupal 10.6.21 updates several Symfony packages to version 6.4.50. These are branch-specific dependency changes, not a statement that every installed Symfony package uses the same version. The updated packages include HTTP Foundation, HTTP Kernel, Routing, Serializer, Validator, Filesystem and YAML. These changes incorporate upstream corrections, but they do not establish that every Drupal installation was exposed to each reported vulnerability.

Both Drupal 11 releases also update the masterminds/html5 parser to version 2.12.0. The update addresses upstream advisories involving HTML attribute parsing, including the handling of form-feed characters, and other parser and serialization problems. The fixes are documented in the library's security advisory and Drupal's release notes.

A comparison of the tagged drupal/core-recommended package manifests shows a difference between the branches. The Drupal 11.4.12 and 11.3.21 manifests specify masterminds/html5 version constraint ~2.12.0, whereas Drupal 10.6.21 continues to specify ~2.10.0. The Drupal 10 release notes identify the Symfony updates but do not explain the absence of the HTML5 parser update. This dependency difference alone does not establish an exploitable vulnerability in a standard Drupal 10 installation.

Drupal 11.3.21 includes a separate Composer compatibility correction. According to its release notes, core's composer.json now contains missing replace declarations for modules being removed from core in future versions and made available as contributed projects. The correction resolves dependency problems affecting projects such as Admin Toolbar. Sites that introduced temporary replacement declarations in their own Composer configuration may need to remove those workarounds before upgrading. The correction was already present in earlier Drupal 11.4 and 10.6 releases.

Drupal 11.4.12 additionally fixes a regression that prevented the core/scripts/dr and core/scripts/drupal command-line scripts from locating the Composer autoloader when the document root was configured as web/. The release also adds regression tests for nine previously published Drupal core security advisories and includes administrative interface and URL-processing corrections. The added tests do not represent nine new security advisories.

Site administrators evaluating these releases should review their installed dependencies in composer.lock, check for outstanding advisories using composer audit, and test updates against their existing modules and Composer configuration. Drupal's release pages document the command composer update "drupal/core-*" --with-all-dependencies for updating core packages and their dependencies. Drupal 10 sites must also plan separately for the branch's scheduled end of life on 9 December 2026, while Drupal 11.4.x is scheduled to receive security coverage until 21 April 2027.