On 1 June 2026 Laravel published GHSA-5vg9-5847-vvmq, tracked as CVE-2026-48019: a CRLF injection (CWE-93) in the default email validation rule. It is rated High (CVSS 3.1 8.9). Combined with how Symfony Mailer and Symfony Mime handle certain character sequences, it may let an unauthenticated attacker interfere with outbound email.
What's affected
Versions before 12.60.0, and 13.9.0 and earlier. Fixed in 12.60.0 and 13.10.0. The advisory lists no workaround. Packagist's entry also lists the 9.x, 10.x and 11.x ranges as affected, and those branches have no listed fix.
The risk applies to applications that send mail to user supplied addresses, such as password resets, sign up confirmations and contact forms. Whether it can be abused depends on what you send and how your mail infrastructure is set up.
How to check if you're exposed
composer show laravel/framework | grep versions
grep -rnE "'email'|\"email\"|Rule::email|Mail::to\(" app routes
Hits on Mail::to($request->email) after the default email rule mean the vulnerable path is in use.
What to do now
- Upgrade to 12.60.0 or 13.10.0 or later. If you are on Laravel 9 to 11, plan the move to a supported line.
- Review flows that send mail to an address a user typed, starting with password reset and invitations.
- Check your mail logs for recipient lists or headers that look wrong since the advisory date.
How this could have been avoided
- Verify addresses by sending only to ones the user confirmed. A confirmation step turns a hostile string into a rejected one.
- Reject control characters at the boundary. A strict allow list on the address field removes CR and LF before any mailer sees them.
- Use an outbound mail provider with per message recipient limits. It caps the damage of any relay abuse.
Why it matters
Validation rules are a dependency like any other: when one is wrong, everything that trusted it is wrong. The reachability question is short here. Does user input flow from the email rule into a mailer? A code search tells you in a few minutes.
Quick check
Which Laravel versions fix CVE-2026-48019?
12.60.0 and 13.10.0 or later.
