CVE-2026-48019: Laravel Framework CRLF Injection Vulnerability

CVE-2026-48019 Overview

CVE-2026-48019 is a Carriage Return Line Feed (CRLF) injection vulnerability in the Laravel PHP web application framework. The flaw resides in Laravel's email validation logic and interacts with how Symfony Mailer and Symfony Mime process specific character sequences. An unauthenticated remote attacker can supply a crafted email address containing line-break characters to interfere with outbound email processing. Applications that send mail to user-supplied addresses, such as password reset or account verification flows, are exposed. Laravel patched the issue in versions 12.60.0 and 13.10.0. The weakness is tracked under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Unauthenticated attackers can inject CRLF sequences into outbound email headers, enabling header manipulation, mail flow disruption, and downstream integrity abuse of transactional email pipelines.

Affected Products

Laravel Framework versions prior to 12.60.0
Laravel Framework versions prior to 13.10.0
Applications relying on Laravel's email validation with Symfony Mailer and Symfony Mime

Discovery Timeline

2026-09-04 - CVE-2026-48019 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-48019

Vulnerability Analysis

The vulnerability stems from Laravel's email validator accepting strings containing \r (carriage return) and \n (line feed) characters. When these values are subsequently passed to Symfony Mailer and Symfony Mime for outbound delivery, the embedded CRLF sequences can be interpreted as header boundaries. Attackers exploit this to inject additional headers, forge recipients, or alter message structure. Because the attack targets applications that email user-supplied addresses, common entry points include registration forms, password reset flows, and newsletter subscriptions. Successful injection compromises the integrity and confidentiality of outbound mail without requiring authentication.

Root Cause

Laravel's ValidatesAttributes trait did not reject inputs containing line-break characters before delegating to Symfony's email validation strategies. The Illuminate\Mail\Mailables\Address class similarly accepted address strings without sanitizing control characters. Combined with Symfony Mailer's handling of specific character sequences, this permitted CRLF payloads to survive validation and reach the mail transport layer.

Attack Vector

An unauthenticated attacker submits a crafted email address containing embedded \r\n characters through any Laravel endpoint that validates and mails to user-supplied addresses. The malicious address bypasses validation, then Symfony Mailer processes the sequence during header assembly. This allows the attacker to inject arbitrary Simple Mail Transfer Protocol (SMTP) headers or manipulate the message envelope.

php

// Security patch in src/Illuminate/Validation/Concerns/ValidatesAttributes.php
// Rejects email inputs containing CR or LF characters before validation proceeds
            return false;
        }

+        if (preg_match('/[\r\n]/', (string) $value) > 0) {
+            return false;
+        }
+
        $validations = (new Collection($parameters))
            ->unique()
            ->map(fn ($validation) => match (true) {

Source: Laravel Framework Commit 96e9a66

php

// Security patch in src/Illuminate/Mail/Mailables/Address.php
// Adds InvalidArgumentException import to support runtime rejection of malformed addresses

 namespace Illuminate\Mail\Mailables;

+use InvalidArgumentException;
+
 class Address
 {
    /**

Source: Laravel Framework Commit f336ba7

Detection Methods for CVE-2026-48019

Indicators of Compromise

Web server access logs showing email form submissions with URL-encoded %0d%0a or raw CR/LF byte sequences in address fields
Outbound mail queue entries containing unexpected headers such as Bcc:, Cc:, or duplicate To: fields not generated by the application
Mail Transfer Agent (MTA) logs recording bounce spikes or SMTP protocol errors tied to malformed recipient headers
Application error logs referencing Symfony\Component\Mime\Exception around address parsing after upgrading

Detection Strategies

Inspect HTTP request payloads for control characters in fields validated with Laravel's email rule
Correlate application user-input events with subsequent SMTP transactions using a centralized logging platform
Deploy Web Application Firewall (WAF) signatures that block \r, \n, %0d, and %0a sequences in parameters expected to hold email addresses

Monitoring Recommendations

Track outbound message volumes per user session to detect anomalous bursts triggered by header injection
Alert on any registration, password reset, or contact endpoint receiving addresses that fail the post-patch validator
Continuously monitor Laravel and Composer dependency versions across production hosts to confirm framework patch status

How to Mitigate CVE-2026-48019

Immediate Actions Required

Upgrade Laravel Framework to version 12.60.0 or 13.10.0 using composer update laravel/framework
Audit all controllers and form requests using the email validation rule to confirm they inherit the patched behavior
Review recent outbound mail logs for evidence of CRLF injection attempts against user-facing forms

Patch Information

Laravel released fixes in v12.60.0 and v13.10.0. The patches, discussed in Pull Request #60151 and detailed in GHSA-5vg9-5847-vvmq, add a preg_match('/[\r\n]/', ...) guard in ValidatesAttributes and strengthen the Address mailable class to reject line breaks.

Workarounds

Add a custom validation rule that rejects any address containing \r or \n before invoking Laravel's built-in email validator
Sanitize user-supplied email inputs at the controller layer using preg_replace('/[\r\n]+/', '', $email) prior to mail dispatch
Configure the upstream WAF or reverse proxy to strip or block requests carrying encoded CRLF sequences in email parameters

bash

# Upgrade Laravel to the patched release using Composer
composer require laravel/framework:^13.10.0
# Verify installed version
php artisan --version