Is illuminate/database 4.1 vulnerable?
Composer · 31 releases from 4.1.0 to 4.1.30 · latest illuminate/database is 13.40.0 · checked 5 Nov 2026
Yes: 2 known advisories
Yes. illuminate/database 4.1.30, the last 4.1 release, is affected by 2 known security advisories (2 high). 1 more affects earlier 4.1.x releases. Upgrade to 6.20.26 or later to fix all of them.
composer require illuminate/database:^6.20.26Advisories affecting illuminate/database 4.1.30
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
- Affected
- >=8.0.0 <8.40.0 · <6.20.26
- Fixed in
- 6.20.26, 8.40.0
Unexpected database bindings
- Affected
- <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Fixed within 4.1.x, affecting earlier releases
Laravel Risk of mass-assignment vulnerabilities
- Affected
- >=4.0.0 <4.1.29
- Fixed in
- 4.1.29
Which of your client projects are still on illuminate/database 4.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact illuminate/database version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other illuminate/database versions
- illuminate/database 5.1
- illuminate/database 5.0
- illuminate/database 4.2
- illuminate/database 4.0
- illuminate/database 1.1
- illuminate/database 1.0
- illuminate/database 13.40
- illuminate/database 13.39
- illuminate/database 13.38
- illuminate/database 13.37
- illuminate/database 13.36
- illuminate/database 13.35
- All illuminate/database advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.