LARAVEL/FRAMEWORK · GHSA-v5ch-g375-82r6 · Package
FIX → 13.41.0 · 12.72.0
When a long request exceeds PHP's max_input_vars limit, the expires parameter can be dropped from the parsed query while the signature is still checked against the raw query string. An attacker can then reuse an expired temporary signed URL and have it accepted.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on laravel/framework that use signed temporary URLs (the signed middleware with expires) are exposed. The risk needs a request line long enough to exceed PHP's max_input_vars, which depends on server and proxy limits. Apps that do not use temporary signed URLs, or whose web server rejects long URLs, are less exposed.
Not affected if no-signed-urls, short-url-limit
Who cares laravel, php, signed-urls
composer.lock for laravel/framework.max_input_vars setting with php -i | grep max_input_vars.When PHP's max_input_vars limit causes the expires query parameter to be dropped from the parsed query, Laravel's signed URL validation can still verify the signature against the raw query string. signatureHasNotExpired() then treats the URL as non-expiring, so an expired temporary signed URL may be accepted. Exploitation requires a request line long enough to exceed max_input_vars, which depends on server and proxy limits.
This issue has been patched in Laravel 12.72.0 and 13.41.0: https://github.com/laravel/framework/pull/62349. Users should upgrade to one of these versions or later.
signed that returns an error when the raw query has more pairs than max_input_vars or when expires appears in the raw query but is missing from the parsed one.Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
signedUpgrade to 13.41.0 · 12.72.0
laravel/framework 12.72.0 for the 12.x linelaravel/framework 13.41.0 for the 13.x line