Reverb security advisories
Latest release 1.12.0 laravel/reverb
No open advisories.
Check your version
Type the Reverb version you run to see which advisories affect it.
All Reverb advisories
2 advisories, newest first.
-
critical Laravel · · Reviewed
Laravel Reverb: Remote Code Execution Through Redis When Scaling Is Enabled
Allows remote code execution in Reverb apps with REVERB_SCALING_ENABLED=true by anyone who can publish to the Redis server Reverb uses.
Fixed in 1.7.0
-
high Laravel · · Reviewed
Laravel Reverb: Pusher API Requests Accepted Without Signature Checks
Lets anyone who knows the app ID send events or read channel data through Reverb's Pusher-compatible HTTP API without a valid signature.
Fixed in 1.4.0