Is laravel/framework 6.9 vulnerable?
Composer · 1 release from 6.9.0 to 6.9.0 · latest laravel/framework is 13.40.0 · checked 5 Nov 2026
Yes: 16 known advisories
Yes. laravel/framework 6.9.0, the last 6.9 release, is affected by 16 known security advisories (3 critical, 8 high, 4 medium, 1 low), including CVE-2026-114509, CVE-2019-9081, CVE-2026-48019. Upgrade to 12.69.0 or later to fix all of them.
composer require laravel/framework:^12.69.0Advisories affecting laravel/framework 6.9.0
Laravel TokenGuard authentication bypass through non-string API credentials
- Affected
- >=13.0.0 <13.29.0 · <12.68.0
- Fixed in
- 12.68.0, 13.29.0
Laravel: XSS in Debug Page Information
- Affected
- <12.69.0 · >=13.0.0 <13.30.0
- Fixed in
- 12.69.0, 13.30.0
Laravel Framework: Temporary Signed URL Path Confusion
- Affected
- >=13.0.0 <13.12.0 · <12.61.1
- Fixed in
- 12.61.1, 13.12.0
Laravel Framework: CRLF injection in default email rule
- Affected
- >=13.0.0 <13.10.0 · <12.60.0
- Fixed in
- 12.60.0, 13.10.0
Laravel has a File Validation Bypass
- Affected
- >=12.0.0 <12.1.1 · >=11.0.0 <11.44.1 · <10.48.29
- Fixed in
- 10.48.29, 11.44.1, 12.1.1
Laravel environment manipulation via query string
- Affected
- <6.20.45 · >=7.0.0 <7.30.7 · >=8.0.0 <8.83.28 · >=9.0.0 <9.52.17 · >=10.0.0 <10.48.23 · >=11.0.0 <11.31.0
- Fixed in
- 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
laravel framework SQL Injection via limit and offset functions
- Affected
- >=6.0.0 <6.20.26 · >=7.0.0 <7.30.5 · >=8.0.0 <8.40.0
- Fixed in
- 6.20.26, 7.30.5, 8.40.0
laravel framework Unexpected database bindings via requests
- Affected
- >=6.0.0 <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Laravel Guard bypass in Eloquent models
- Affected
- >=5.5.0 <=5.5.49 · >=6.0.0 <6.18.34 · >=7.0.0 <7.23.2
- Fixed in
- 6.18.34, 7.23.2
Laravel RCE vulnerability in "cookie" session driver
- Affected
- >=4.1.0 <6.18.31 · >=7.0.0 <7.22.4
- Fixed in
- 6.18.31, 7.22.4
Laravel Framework Deserialization Vulnerability
- Affected
- >=5.7.0 <6.20.44
- Fixed in
- 6.20.44
Laravel Framework XSS in Blade templating engine
- Affected
- <6.20.42 · >=7.0.0 <7.30.6 · >=8.0.0 <8.75.0
- Fixed in
- 6.20.42, 7.30.6, 8.75.0
Improper Input Validation in Laravel
- Affected
- <6.18.35 · >=7.0.0 <7.24.0
- Fixed in
- 6.18.35, 7.24.0
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
- Affected
- >=8.0.0 <8.40.0 · <6.20.26
- Fixed in
- 6.20.26, 8.40.0
Unexpected database bindings
- Affected
- <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Query Binding Exploitation
- Affected
- >=8.0.0 <8.22.1 · >=6.0.0 <6.20.11 · >=7.0.0 <7.30.2
- Fixed in
- 6.20.11, 7.30.2, 8.22.1
Which of your client projects are still on laravel/framework 6.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact laravel/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other laravel/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.