spatie url-signer CVE-2026-121589

The application must use spatie/url-signer at version 2.1.3 or earlier AND pass an attacker-controllable URL (including its query string) to AbstractUrlSigner::validate() or BaseUrlSigner::validate(). The attacker supplies a malformed expires parameter - an array (expires[]=9999999999 or nested), empty (expires=), non-numeric (expires=abc), partially numeric (9999999999abc), decimal (9999999999.0), scientific-notation (1e10), or excessively long value - which pre-patch was not normalized via FILTER_VALIDATE_INT before the expiration comparison. No authentication (PR:N) and no user interaction (UI:N) are required. LIMITING FACTORS: impact is confined to availability (VA:L) with no confidentiality or integrity effect; exploitation requires that the host application actually routes untrusted query strings into the signer's validate() method, so apps that only validate self-generated URLs are not meaningfully exposed.

This is a medium-severity, low-real-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity flaw, but the impact metrics tell the real story: VC:N/VI:N/VA:L - no confidentiality or integrity impact and only LOW availability impact, scoring 5.5 (medium). The source code confirms the mechanism: AbstractUrlSigner::validate() (and BaseUrlSigner::validate()) read the attacker-controllable expires query parameter and passed it straight into isFuture() without validating its type, so malformed values (arrays, empty, non-numeric, decimal, or scientific-notation strings) triggered incorrect type conversion (CWE-704) rather than a clean rejection - consistent with the availability-only impact. Exploit maturity is E:P (Proof of Concept) and the vuldb-sourced description claims a public exploit, but this is NOT in CISA KEV and NO EPSS score was provided, so there is no evidence of widespread automated exploitation. The vuldb priority label is 'this_month', not an emergency. Note one conflict: the 'Information Disclosure' tag contradicts the CVSS vector (VC:N) and the actual availability-only impact - the type-confusion flaw does not disclose data per the supplied evidence.

An application uses spatie/url-signer ≤2.1.3 to validate signed URLs and passes an attacker-supplied URL/query string to validate(). The attacker appends or alters the expires parameter with a malformed value such as an array (expires[]=...), a scientific-notation string (expires=1e10), or a non-numeric value, triggering incorrect type conversion inside the validation path. Per the public patch's test cases this previously caused the validator to misbehave rather than cleanly return false; the description claims a public exploit (E:P maturity), though no working exploit code link is included in the references.