CVE-2020-36950

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days.

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-01-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://nova.laravel.com/
https://nova.laravel.com/releases
https://www.exploit-db.com/exploits/49198
https://www.vulncheck.com/advisories/laravel-nova-range-dos

Check your stack JSON