CVE-2026-23524: Laravel Reverb Remote Code Execution via Insecure Deserialization
Summary
CVE-2026-23524: Laravel Redis Horizontal Scaling Insecure Deserialization. Affects laravel/reverb versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel Reverb is a package designed for real-time event broadcasting in Laravel applications, utilizing Redis for message handling. It enables developers to build scalable applications by allowing multiple instances to communicate efficiently. However, when horizontal scaling is enabled, it becomes vulnerable to insecure deserialization, which can lead to severe security risks.
Vulnerability Detail
This vulnerability arises in Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). The issue is exacerbated by the common practice of deploying Redis servers without authentication. With this configuration, Reverb servers communicate through Redis PubSub, passing data directly into PHP's unserialize() function without restrictions on class instantiation. This flaw can lead to Remote Code Execution (RCE), allowing attackers to execute arbitrary code on the server.
How To Fix
Minimum fixed version
1.7.0
This is the first release that contains the fix.
composer require laravel/reverb:1.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.7.0 is not feasible, consider applying the following mitigations: 1. Redis Security: Require a strong password for Redis access and restrict access to the service via a private network or local loopback. 2. Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false in your environment configuration to bypass the vulnerable logic entirely.
Conclusion
The vulnerability identified as CVE-2026-23524 in Laravel Reverb poses a significant risk due to insecure deserialization when horizontal scaling is enabled. It is crucial for developers to update to the patched version or implement recommended workarounds to mitigate potential risks.
See every vulnerability recorded for laravel/reverb →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is Remote Code Execution (RCE), which can allow attackers to execute arbitrary code on your server, potentially leading to data breaches or service disruptions.
No, using Redis without authentication is not safe, especially in environments where sensitive data is handled. It is recommended to secure Redis with a strong password and limit access.
If upgrading is not possible, implement the suggested workarounds, such as securing your Redis instance and disabling horizontal scaling if only one Reverb node is in use.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/reverb.
