Is phpunit/phpunit 12.5 vulnerable?
Composer · 44 releases from 12.5.0 to 12.5.43 · latest phpunit/phpunit is 13.4.6 · checked 2 Nov 2026
No known advisories in the last release
phpunit/phpunit 12.5.43, the last 12.5 release, has no known advisories. 3 advisories affect earlier 12.5.x releases, so update to 12.5.43.
composer require phpunit/phpunit:^12.5.43Fixed within 12.5.x, affecting earlier releases
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
- Affected
- >=12.5.21 <12.5.22 · >=13.1.5 <13.1.6
- Fixed in
- 12.5.22, 13.1.6
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
- Affected
- >=12.5.21 <12.5.22 · >=13.1.5 <13.1.6
- Fixed in
- 12.5.22, 13.1.6
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
- Affected
- <8.5.52 · >=9.0.0 <9.6.33 · >=10.0.0 <10.5.62 · >=11.0.0 <11.5.50 · >=12.0.0 <12.5.8
- Fixed in
- 8.5.52, 9.6.33, 10.5.62, 11.5.50, 12.5.8
Which of your client projects are still on phpunit/phpunit 12.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpunit/phpunit version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpunit/phpunit versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.