Is phpmailer/phpmailer 6.3 vulnerable?
Composer · 1 release from 6.3.0 to 6.3.0 · latest phpmailer/phpmailer is 7.1.1 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. phpmailer/phpmailer 6.3.0, the last 6.3 release, is affected by 3 known security advisories (1 critical, 2 high), including CVE-2020-36326, CVE-2021-3603, CVE-2021-34551. Upgrade to 6.5.0 or later to fix all of them.
composer require phpmailer/phpmailer:^6.5.0Advisories affecting phpmailer/phpmailer 6.3.0
PHPMailer untrusted code may be run from an overridden address validator
- Affected
- <6.5.0
- Fixed in
- 6.5.0
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
- Affected
- <6.5.0
- Fixed in
- 6.5.0
Object injection in PHPMailer/PHPMailer
- Affected
- >=6.1.8 <6.4.1
- Fixed in
- 6.4.1
Which of your client projects are still on phpmailer/phpmailer 6.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpmailer/phpmailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpmailer/phpmailer versions
- phpmailer/phpmailer 6.6
- phpmailer/phpmailer 6.5
- phpmailer/phpmailer 6.4
- phpmailer/phpmailer 6.2
- phpmailer/phpmailer 6.1
- phpmailer/phpmailer 6.0
- phpmailer/phpmailer 7.1
- phpmailer/phpmailer 7.0
- phpmailer/phpmailer 6.12
- phpmailer/phpmailer 6.11
- phpmailer/phpmailer 6.10
- phpmailer/phpmailer 6.9
- All phpmailer/phpmailer advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.