Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.
What to do
Update to the latest Laravel 13.x or 12.x patch release.
Three framework advisories landed this summer: a High-severity CRLF injection in the default email validation rule (June 1), a temporary signed URL path confusion (June 8) and a low-severity XSS in the debug page (September 10).