Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36950Laravel Nova 3.7.0 - 'range' DoS
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Laravel Nova from Laravel Holdings Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 68.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Laravel Holdings Inc. | Laravel Nova | 3.7.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- ExploitDB-49198 exploit
- Laravel Nova Official Homepage product
- Laravel Nova Releases Page patch
- VulnCheck Advisory: Laravel Nova 3.7.0 - 'range' DoS third-party-advisory