Is phpseclib/phpseclib 2.0 vulnerable?
Composer · 57 releases from 2.0.0 to 2.0.56 · latest phpseclib/phpseclib is 4.0.3 · checked 2 Nov 2026
Yes: 1 known advisory
Yes. phpseclib/phpseclib 2.0.56, the last 2.0 release, is affected by 1 known security advisory (1 medium), including CVE-2026-84308. 8 more affect earlier 2.0.x releases. Upgrade to 3.0.57 or later to fix all of them.
composer require phpseclib/phpseclib:^3.0.57Advisories affecting phpseclib/phpseclib 2.0.56
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
- Affected
- <3.0.57 · >=4.0.0 <4.0.1
- Fixed in
- 3.0.57, 4.0.1
Fixed within 2.0.x, affecting earlier releases
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
- Affected
- >=0.1.1 <1.0.30 · >=2.0.0 <2.0.55 · >=3.0.0 <3.0.54
- Fixed in
- 1.0.30, 2.0.55, 3.0.54
phpseclib guardrails needed on OID length
- Affected
- >=2.0.0 <2.0.47 · >=3.0.0 <3.0.36 · >=0.1.1 <1.0.23
- Fixed in
- 1.0.23, 2.0.47, 3.0.36
phpseclib: guardrails needed on isPrime and randomPrime
- Affected
- >=0.1.1 <1.0.23 · >=2.0.0 <2.0.47 · >=3.0.0 <3.0.36
- Fixed in
- 1.0.23, 2.0.47, 3.0.36
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
- Affected
- >=0.1.1 <1.0.29 · >=2.0.0 <2.0.54 · >=3.0.0 <3.0.52
- Fixed in
- 1.0.29, 2.0.54, 3.0.52
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
- Affected
- >=0.1.1 <1.0.28 · >=2.0.0 <2.0.53 · >=3.0.0 <3.0.51
- Fixed in
- 1.0.28, 2.0.53, 3.0.51
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
- Affected
- >=3.0.0 <3.0.50 · >=2.0.0 <2.0.52 · >=0.1.1 <1.0.27
- Fixed in
- 1.0.27, 2.0.52, 3.0.50
Name confusion in x509 Subject Alternative Name fields
- Affected
- <1.0.22 · >=2.0.0 <2.0.46 · >=3.0.0 <3.0.33
- Fixed in
- 1.0.22, 2.0.46, 3.0.33
Improper Certificate Validation in phpseclib
- Affected
- >=3.0.0 <3.0.7 · <2.0.31
- Fixed in
- 2.0.31, 3.0.7
Which of your client projects are still on phpseclib/phpseclib 2.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpseclib/phpseclib version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpseclib/phpseclib versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.