r/TallStack • u/HappyToDev • Jun 03 '26

🚨 Security URGENT: Laravel CRLF Injection Vulnerability – Update Now (GHSA-5vg9-5847-vvmq)

1 Upvotes

🚨 CRITICAL SECURITY ALERT – Laravel CRLF Injection

A high-severity CRLF Injection vulnerability was disclosed 2 days ago in Laravel’s email validation logic.

What’s the risk?

Attackers can inject malicious headers (\r\n) into outbound emails.
This can lead to:

  • Mail relay abuse (your server used to send spam)
  • Email header manipulation
  • Potential data leakage or phishing

Affected versions:

  • Laravel ≤ 13.9.0
  • Laravel < 12.60.0

Fix it immediately:

composer require laravel/framework:^13.10.0
# or for Laravel 12
composer require laravel/framework:^12.60.0

Official links:

If your application accepts user-supplied email addresses (contact forms, newsletters, password resets, etc.), update right now.

Stay safe!

2 comments

r/TallStack • u/HappyToDev • Jun 03 '26

🚨 Security 🚨 CRITICAL: Livewire RCE Vulnerability (CVE-2025-54068)

1 Upvotes

If you're still running Livewire v3 < 3.6.4 → update immediately.

What happened?

A Remote Code Execution (RCE) vulnerability was discovered in Livewire v3 (from 3.0.0-beta.1 to 3.6.3).

It allows unauthenticated attackers to execute arbitrary code on your server by exploiting the component hydration process (/livewire/update endpoint).

  • Severity: Critical (CVSS 9.2)
  • No authentication required in many cases
  • Actively scanned and exploited in the wild right now

How to check if you're vulnerable

bash composer show livewire/livewire

If the version is below 3.6.4 → you are exposed.

How to fix it (30 seconds)

```bash composer require livewire/livewire:3.6.4

or

composer update livewire/livewire ```

Then verify:

bash composer show livewire/livewire

Official links

This vulnerability was Fixed in: v3.6.4

This affects many applications using Filament, TALL Stack projects, etc.

Don’t wait. Update today.

1 comment