End of life / Laravel / 11 / CVEs
Known CVEs in Laravel 11
7 known CVEs reach Laravel 11, the most severe rated HIGH. Every one of them publishes an affected range that includes this release.
By severity
- HIGH
- 2
- MEDIUM
- 4
- LOW
- 1
Every advisory that reaches 11
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule | HIGH | 8.9 | 17 June 2026 | 12.60.0 |
| CVE-2024-52301 Laravel environment manipulation via query string | HIGH | 8.7 | 12 November 2024 | 11.31.0 |
| CVE-2025-27515 Laravel has a File Validation Bypass | MEDIUM | 6.9 | 5 March 2025 | 11.44.1 |
| CVE-2024-13918 Laravel framework susceptible to reflected cross-site scripting | MEDIUM | 4.7 | 10 March 2025 | 11.36.0 |
| CVE-2024-13919 Laravel framework susceptible to reflected cross-site scripting | MEDIUM | 4.7 | 10 March 2025 | 11.36.0 |
| GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion | MEDIUM | 4.2 | 17 June 2026 | 12.61.1 |
| CVE-2026-102279 Laravel: XSS in Debug Page Information | LOW | 3.1 | 29 September 2026 | 12.69.0 |
Support dates for this release
Laravel 11 end of life carries the support window, the countdown to it and the release to move to next. This one is End of life and leaves support on 12 March 2026.
Vendor sources last checked 22 October 2026, and checked daily. This data last changed on 22 October 2026.
Be told before Laravel 11 runs out
One email, ahead of the date, and nothing else. No account, no newsletter, and every message carries a link that stops them for good.
This is one release, on one machine, read by hand
You had to already know which release you were on to look this up. StackDrift scans your machines, works out the build each one is running and mails you when a CVE lands on something you have deployed, across every runtime, operating system and kernel underneath your code.
A card is needed to open the trial and nothing is charged until it ends.