Executive brief
Laravel is a popular web application framework used to build business applications. A flaw in how it validates email addresses allows an attacker to inject carriage return and line feed characters, potentially allowing them to manipulate outbound email messages sent to user-supplied addresses. This could result in emails being sent to unintended recipients or with altered content, impacting customer communication and trust.
Technical details
A CRLF injection vulnerability exists in Laravel's email validation logic, specifically in how it processes the Address class. The vulnerability arises from insufficient validation of carriage return (\r) and line feed (\n) characters in email address strings. When combined with how Symfony Mailer and Symfony Mime libraries handle certain character sequences, an unauthenticated attacker can craft a malicious email address that breaks out of the intended email headers and injects arbitrary email headers or content. The attack requires that the application accepts and sends mail to user-supplied email addresses. The fix, implemented in versions 12.60.0 and 13.10.0, adds regex validation to reject email addresses containing line break characters using preg_match('/[\r\n]/', $address).
Affected products
- Laravel Laravel prior to 12.60.0 and 13.10.0
Timeline
- 2026-09-04: disclosed
- 2026-05-17: patched: Patch committed to framework; versions 12.60.0 and 13.10.0 contain the fix