Backend framework
Laravel: supported versions and open vulnerabilities today
Laravel 13 and 12 are supported (12 until Feb 24, 2027); 11 reached end of life on Mar 12, 2026; the latest release is 13.37.0. 1 high or critical advisory for Laravel was published in the last 12 months; one advisory (CVE-2018-15133) is on CISA’s list of vulnerabilities exploited in the wild.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 13.37.0
- GitHub stars
- 35k
- Licence
- MIT
- OpenSSF Scorecard
- 5.8 / 10
Supported versions
Security advisories
3 advisories published in the last 12 months, 1 of them high or critical. 26 in total since records began. Checked packages: laravel/framework.
Older advisories CISA lists as exploited in the wild
- CVE-2018-15133 added ; fixed in 5.6.30.
Laravel Framework: CRLF injection in default email rule
Fixed in 12.60.0 and 13.10.0.
EPSS: top 58%
Maintenance and supply chain
OpenSSF Scorecard 5.8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 2 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
Docs and release notes
Check Laravel in your own stack
This page checks Laravel in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.