GHSA-6jvx-8ch9-j2jr: Laravel Cookie serialization vulnerability

The vulnerability stems from unsafe deserialization of cookie values after decryption. Prior to Laravel 5.6.30, the framework allowed serialized cookies by default through the EncryptCookies middleware's $serialize property. The Encrypter::decrypt method would call unserialize() on decrypted data when serialization was enabled, creating a CWE-502 vulnerability. The patch in 5.6.30 disabled serialization by default, removing this unsafe deserialization path. The Encrypter::decrypt method is directly responsible for the vulnerable deserialization when handling serialized cookies.