Is phpseclib/phpseclib 1.0 vulnerable?
Composer · 32 releases from 1.0.0 to 1.0.31 · latest phpseclib/phpseclib is 4.0.3 · checked 2 Nov 2026
Yes: 2 known advisories
Yes. phpseclib/phpseclib 1.0.31, the last 1.0 release, is affected by 2 known security advisories (1 high, 1 medium), including CVE-2021-30130, CVE-2026-84308. 7 more affect earlier 1.0.x releases. Upgrade to 3.0.57 or later to fix all of them.
composer require phpseclib/phpseclib:^3.0.57Advisories affecting phpseclib/phpseclib 1.0.31
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
- Affected
- <3.0.57 · >=4.0.0 <4.0.1
- Fixed in
- 3.0.57, 4.0.1
Improper Certificate Validation in phpseclib
- Affected
- >=3.0.0 <3.0.7 · <2.0.31
- Fixed in
- 2.0.31, 3.0.7
Fixed within 1.0.x, affecting earlier releases
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
- Affected
- >=0.1.1 <1.0.30 · >=2.0.0 <2.0.55 · >=3.0.0 <3.0.54
- Fixed in
- 1.0.30, 2.0.55, 3.0.54
phpseclib guardrails needed on OID length
- Affected
- >=2.0.0 <2.0.47 · >=3.0.0 <3.0.36 · >=0.1.1 <1.0.23
- Fixed in
- 1.0.23, 2.0.47, 3.0.36
phpseclib: guardrails needed on isPrime and randomPrime
- Affected
- >=0.1.1 <1.0.23 · >=2.0.0 <2.0.47 · >=3.0.0 <3.0.36
- Fixed in
- 1.0.23, 2.0.47, 3.0.36
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
- Affected
- >=0.1.1 <1.0.29 · >=2.0.0 <2.0.54 · >=3.0.0 <3.0.52
- Fixed in
- 1.0.29, 2.0.54, 3.0.52
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
- Affected
- >=0.1.1 <1.0.28 · >=2.0.0 <2.0.53 · >=3.0.0 <3.0.51
- Fixed in
- 1.0.28, 2.0.53, 3.0.51
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
- Affected
- >=3.0.0 <3.0.50 · >=2.0.0 <2.0.52 · >=0.1.1 <1.0.27
- Fixed in
- 1.0.27, 2.0.52, 3.0.50
Name confusion in x509 Subject Alternative Name fields
- Affected
- <1.0.22 · >=2.0.0 <2.0.46 · >=3.0.0 <3.0.33
- Fixed in
- 1.0.22, 2.0.46, 3.0.33
Which of your client projects are still on phpseclib/phpseclib 1.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpseclib/phpseclib version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpseclib/phpseclib versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.