diff --git a/src/Illuminate/Foundation/Http/Middleware/Concerns/ExcludesPaths.php b/src/Illuminate/Foundation/Http/Middleware/Concerns/ExcludesPaths.php
index 622d9dd0b5da..941b2fec5cf9 100644
--- a/src/Illuminate/Foundation/Http/Middleware/Concerns/ExcludesPaths.php
+++ b/src/Illuminate/Foundation/Http/Middleware/Concerns/ExcludesPaths.php
@@ -4,13 +4,6 @@
 
 trait ExcludesPaths
 {
-    /**
-     * The URIs that should be excluded.
-     *
-     * @var array<int, string>
-     */
-    protected $except = [];
-
     /**
      * Determine if the request has a URI that should be excluded.
      *
@@ -39,6 +32,6 @@ protected function inExceptArray($request)
      */
     public function getExcludedPaths()
     {
-        return $this->except;
+        return $this->except ?? [];
     }
 }
diff --git a/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php b/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php
index 0ecfa38598e5..6adb87d01161 100644
--- a/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php
+++ b/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php
@@ -21,6 +21,13 @@ class PreventRequestsDuringMaintenance
      */
     protected $app;
 
+    /**
+     * The URIs that should be excluded.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [];
+
     /**
      * The URIs that should be accessible during maintenance.
      *
diff --git a/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php b/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php
index ba2f67e6af11..5edc53d38f57 100644
--- a/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php
+++ b/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php
@@ -34,6 +34,13 @@ class VerifyCsrfToken
      */
     protected $encrypter;
 
+    /**
+     * The URIs that should be excluded.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [];
+
     /**
      * The globally ignored URIs that should be excluded from CSRF verification.
      *