composer

paragonie/sodium_compat

Security advisories for paragonie/sodium_compat, newest first. 3 known, all fixed. If you’re on 2.5.1 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

2.5.2

Advisories

3 · 0 unfixed

Last advisory

18 Aug 2026

Safe from

2.5.1

3 advisories · newest first

UNRATED 18 Aug 2026

Incorrect Ed25519 public key validation

PKSA-32g2-byr9-drtw

Affected

< 1.24.1 ≥ 2, < 2.5.1

Fixed in

1.24.1 2.5.1

Published

18 Aug 2026

MODERATE4.5 31 Dec 2025

libsodium has Incomplete List of Disallowed Inputs

GHSA-mrfv-m5wm-5w6w · CVE-2025-69277

Affected

< 1.24.0 ≥ 2, < 2.5.0

Fixed in

1.24.0 2.5.0

Published

31 Dec 2025

UNRATED 30 Dec 2025

Missing check that a point is on the prime subgroup for Edwards25519

PKSA-8x19-j2j3-bn67

Affected

< 1.24.0 ≥ 2, < 2.5.0

Fixed in

1.24.0 2.5.0

Published

30 Dec 2025

/advisories/composer/paragonie/sodium_compat/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →