Is phpunit/phpunit 5.1 vulnerable?
Composer · 8 releases from 5.1.0 to 5.1.7 · latest phpunit/phpunit is 13.4.6 · checked 3 Nov 2026
Yes: 2 known advisories
Yes. phpunit/phpunit 5.1.7, the last 5.1 release, is affected by 2 known security advisories (1 critical, 1 high), including CVE-2017-9841, CVE-2026-24765. Upgrade to 8.5.52 or later to fix all of them.
composer require phpunit/phpunit:^8.5.52Advisories affecting phpunit/phpunit 5.1.7
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
- Affected
- <8.5.52 · >=9.0.0 <9.6.33 · >=10.0.0 <10.5.62 · >=11.0.0 <11.5.50 · >=12.0.0 <12.5.8
- Fixed in
- 8.5.52, 9.6.33, 10.5.62, 11.5.50, 12.5.8
Code Injection in PHPUnit
- Affected
- >=4.8.19 <4.8.28 · >=5.0.10 <5.6.3
- Fixed in
- 4.8.28, 5.6.3
Which of your client projects are still on phpunit/phpunit 5.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpunit/phpunit version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpunit/phpunit versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.