GHSA-6jvx-8ch9-j2jr
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
What each source reports
GitHub AdvisoriesNo score
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
- Record
GHSA-6jvx-8ch9-j2jr- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVNo score
Laravel Cookie serialization vulnerability
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
- Record
GHSA-6jvx-8ch9-j2jr- Weakness
- CWE-502
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
laravel/frameworkPackagist | 5.5.0 up to 5.6.30 | 5.6.30 |
laravel/frameworkPackagist | 5.5.0 up to 5.6.30, plus listed versions v5.5.0v5.5.1v5.5.10v5.5.11v5.5.12 Show 45 moreShow lessv5.5.13v5.5.14v5.5.15v5.5.16v5.5.17v5.5.18v5.5.19v5.5.2v5.5.20v5.5.21v5.5.22v5.5.23v5.5.24v5.5.25v5.5.26v5.5.27v5.5.28v5.5.29v5.5.3v5.5.30v5.5.31v5.5.32v5.5.33v5.5.34v5.5.35v5.5.36v5.5.37v5.5.38v5.5.39v5.5.4v5.5.40v5.5.41v5.5.42v5.5.43v5.5.44v5.5.45v5.5.46v5.5.47v5.5.48v5.5.49v5.5.5v5.5.50v5.5.6v5.5.7v5.5.8 | 5.6.30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-6jvx-8ch9-j2jr is a vulnerability with no CVSS score yet in laravel/framework, published May 15, 2024. No source lists public exploit code. Fixed in laravel/framework 5.6.30.
References
Left out here: 31 versions. The JSON record has them.