Is laravel/framework 8.10 vulnerable?

Composer · 1 release from 8.10.0 to 8.10.0 · latest laravel/framework is 13.40.0 · checked 5 Nov 2026

Yes: 12 known advisories

Yes. laravel/framework 8.10.0, the last 8.10 release, is affected by 12 known security advisories (1 critical, 7 high, 3 medium, 1 low), including CVE-2026-114509, CVE-2026-48019, CVE-2024-52301. Upgrade to 12.69.0 or later to fix all of them.

Upgrade with:composer require laravel/framework:^12.69.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Get an email when laravel/framework has a new advisory

We confirm your address first. See our privacy policy.

Advisories affecting laravel/framework 8.10.0

  • CriticalCVE-2026-114509GHSA-f9x3-7vq9-cph623 Oct 2026

    Laravel TokenGuard authentication bypass through non-string API credentials

    Affected
    >=13.0.0 <13.29.0 · <12.68.0
    Fixed in
    12.68.0, 13.29.0
  • LowCVE-2026-102279GHSA-jh5r-qr3c-85q829 Sept 2026

    Laravel: XSS in Debug Page Information

    Affected
    <12.69.0 · >=13.0.0 <13.30.0
    Fixed in
    12.69.0, 13.30.0
  • MediumGHSA-crmm-hgp2-wgrp17 Jun 2026

    Laravel Framework: Temporary Signed URL Path Confusion

    Affected
    >=13.0.0 <13.12.0 · <12.61.1
    Fixed in
    12.61.1, 13.12.0
  • HighCVE-2026-48019GHSA-5vg9-5847-vvmq17 Jun 2026

    Laravel Framework: CRLF injection in default email rule

    Affected
    >=13.0.0 <13.10.0 · <12.60.0
    Fixed in
    12.60.0, 13.10.0
  • MediumCVE-2025-27515GHSA-78fx-h6xr-vch45 Mar 2025

    Laravel has a File Validation Bypass

    Affected
    >=12.0.0 <12.1.1 · >=11.0.0 <11.44.1 · <10.48.29
    Fixed in
    10.48.29, 11.44.1, 12.1.1
  • HighCVE-2024-52301GHSA-gv7v-rgg6-548h12 Nov 2024

    Laravel environment manipulation via query string

    Affected
    <6.20.45 · >=7.0.0 <7.30.7 · >=8.0.0 <8.83.28 · >=9.0.0 <9.52.17 · >=10.0.0 <10.48.23 · >=11.0.0 <11.31.0
    Fixed in
    6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
  • HighGHSA-wq8p-mqvg-2p5h15 May 2024

    laravel framework SQL Injection via limit and offset functions

    Affected
    >=6.0.0 <6.20.26 · >=7.0.0 <7.30.5 · >=8.0.0 <8.40.0
    Fixed in
    6.20.26, 7.30.5, 8.40.0
  • HighGHSA-jwvj-pwww-3mj515 May 2024

    laravel framework Unexpected database bindings via requests

    Affected
    >=6.0.0 <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
    Fixed in
    6.20.14, 7.30.4, 8.24.0
  • MediumCVE-2021-43808GHSA-66hf-2p6w-jqfw8 Dec 2021

    Laravel Framework XSS in Blade templating engine

    Affected
    <6.20.42 · >=7.0.0 <7.30.6 · >=8.0.0 <8.75.0
    Fixed in
    6.20.42, 7.30.6, 8.75.0
  • HighGHSA-4mg9-vhxq-vm7j29 Apr 2021

    SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

    Affected
    >=8.0.0 <8.40.0 · <6.20.26
    Fixed in
    6.20.26, 8.40.0
  • HighGHSA-x7p5-p2c9-phvg2 Feb 2021

    Unexpected database bindings

    Affected
    <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
    Fixed in
    6.20.14, 7.30.4, 8.24.0
  • HighCVE-2021-21263GHSA-3p32-j457-pg5x19 Jan 2021

    Query Binding Exploitation

    Affected
    >=8.0.0 <8.22.1 · >=6.0.0 <6.20.11 · >=7.0.0 <7.30.2
    Fixed in
    6.20.11, 7.30.2, 8.22.1

Which of your client projects are still on laravel/framework 8.10?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact laravel/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other laravel/framework versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.