Laravel Web Application Framework Vulnerability Affecting Specific Versions
CVE-2026-128083
What is CVE-2026-128083?
The Laravel web application framework has a vulnerability where its Concurrency::run process driver can mishandle forged internal result messages when they originate from child standard output. This occurs if an application route calls Concurrency::run, and a task writes maliciously crafted data at the beginning of the child's standard output. This data must create a valid JSON document, followed by gzip magic bytes. Under such specific conditions, an attacker can exploit this behavior to execute arbitrary code remotely. Importantly, the vulnerability requires vulnerable application code that routes untrusted input into task outputs, making it not exposed by default. The issue has been addressed in Laravel versions 12.71.0 and 13.40.0.
Affected Version(s)
framework >= 13.0.0, < 13.40.0 < 13.0.0, 13.40.0
framework < 12.71.0 < 12.71.0