CVE-2026-23524Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.
Updated under an hour ago ()
Does this affect you?
It affects laravel reverb. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-502
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
laravel reverb laravel:reverb | before 1.7.0 | NVD |
References
- https://cwe.mitre.org/data/definitions/502.htmltechnical-description
- https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1apatch
- https://github.com/laravel/reverb/releases/tag/v1.7.0product, release-notes
- https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4mitigation, vendor-advisory
- https://laravel.com/docs/12.x/reverb#scalingtechnical-description
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.