Our servers are protected against the PHP security vulnerability disclosed in October. The update was installed on 21 October 2026. More about php2shell

Patch

Composer 2.2

Composer 2.2 gets security updates until 31/12/2026.

Supported

Latest version: 2.2.31, released on 29/10/2026

End of support: 31/12/2026

No known vulnerability open in 2.2.31

Vulnerabilities in Composer 2.2

6 vulnerabilities from the NVD affect at least one version of this branch. Last checked on 02/11/2026.

CVE-2026-40261, CVSS 3.1: 8.8: not affected in 2.2.31
CVE-2023-43655, CVSS 3.1: 8.8: fixed in 2.2.21
CVE-2022-24828, CVSS 3.1: 8.8: fixed in 2.2.12
CVE-2026-40176, CVSS 3.1: 7.8: not affected in 2.2.31
CVE-2024-24821, CVSS 3.1: 7.8: fixed in 2.2.23
CVE-2025-67746, CVSS 4.0: 1.3: fixed in 2.2.26

Get notified

Add Composer with your version and Erseni Patch writes to you about new versions, vulnerabilities in exactly your version and the end of support.

Watch Composer 2.2

Already have an account? Log in and add Composer 2.2

All branches of Composer