#laravel

Field Note · May 20, 2026 · Colten Anderson

Laravel CVE-2021-3129: the RCE that only fires when debug mode is on in production

CVE-2021-3129 is unauthenticated remote code execution in Laravel's Ignition error page. It only works when APP_DEBUG is true, which should never be the case in production. Here's how to confirm debug mode is off everywhere, patch, and check whether you were hit.