GHSA-2867-6rrm-38gr
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
What each source reports
GitHub AdvisoriesNo score
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
- Record
GHSA-2867-6rrm-38gr- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVNo score
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
- Record
GHSA-2867-6rrm-38gr- Weakness
- CWE-502
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
illuminate/cookiePackagist | 5.5.0 up to 5.6.30 | 5.6.30 |
illuminate/cookiePackagist | 5.5.0 up to 5.6.30, plus listed versions v5.5.0v5.5.16v5.5.17v5.5.2v5.5.28 Show 39 moreShow lessv5.5.33v5.5.34v5.5.35v5.5.36v5.5.37v5.5.39v5.5.40v5.5.41v5.5.43v5.5.44v5.6.0v5.6.1v5.6.10v5.6.11v5.6.12v5.6.13v5.6.14v5.6.15v5.6.16v5.6.17v5.6.19v5.6.2v5.6.20v5.6.21v5.6.22v5.6.23v5.6.24v5.6.25v5.6.26v5.6.27v5.6.28v5.6.29v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9 | 5.6.30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2867-6rrm-38gr is a vulnerability with no CVSS score yet in illuminate/cookie, published May 15, 2024. No source lists public exploit code. Fixed in illuminate/cookie 5.6.30.