Is phpmailer/phpmailer 6.4 vulnerable?

Composer · 2 releases from 6.4.0 to 6.4.1 · latest phpmailer/phpmailer is 7.1.1 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. phpmailer/phpmailer 6.4.1, the last 6.4 release, is affected by 2 known security advisories (2 high), including CVE-2021-3603, CVE-2021-34551. 1 more affects earlier 6.4.x releases. Upgrade to 6.5.0 or later to fix all of them.

Upgrade with:composer require phpmailer/phpmailer:^6.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting phpmailer/phpmailer 6.4.1

  • HighCVE-2021-3603GHSA-77mr-wc79-m8j322 Jun 2021

    PHPMailer untrusted code may be run from an overridden address validator

    Affected
    <6.5.0
    Fixed in
    6.5.0
  • HighCVE-2021-34551GHSA-7q44-r25x-wm4q22 Jun 2021

    Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

    Affected
    <6.5.0
    Fixed in
    6.5.0

Fixed within 6.4.x, affecting earlier releases

  • CriticalCVE-2020-36326GHSA-m298-fh5c-jc664 May 2021

    Object injection in PHPMailer/PHPMailer

    Affected
    >=6.1.8 <6.4.1
    Fixed in
    6.4.1

Which of your client projects are still on phpmailer/phpmailer 6.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpmailer/phpmailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other phpmailer/phpmailer versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.