dunglas github.com/dunglas/frankenphp vulnerabilities

Latest dunglas github.com/dunglas/frankenphp CVEs

Newest publication first

1. CVE-2026-128014 FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder

   Published 2026-11-13

   Critical·CVSS 9.2 EPSS 0.75% PoC

   FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to b...

2. CVE-2026-128015 FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown

   Published 2026-11-13

   High·CVSS 8.3 EPSS 0.45%

   FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the proces...

3. CVE-2026-128016 FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode

   Published 2026-11-13

   High·CVSS 8.3 EPSS 0.45%

   FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, ca...

4. CVE-2026-128018 FrankenPHP before 1.13.4 Pending Worker Request Denial of Service

   Published 2026-11-13

   Medium·CVSS 6.3 EPSS 0.43%

   FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts...

5. CVE-2026-128017 FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST

   Published 2026-11-13

   Medium·CVSS 6.3 EPSS 0.45%

   FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop e...

6. CVE-2026-128019 FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak

   Published 2026-11-13

   Medium·CVSS 6.3 EPSS 0.32%

   FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through...

7. CVE-2026-128021 FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode

   Published 2026-11-13

   Medium·CVSS 6.3 EPSS 0.30%

   FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_ge...

8. CVE-2026-128020 FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion

   Published 2026-11-13

   High·CVSS 8.2 EPSS 0.45%

   FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stac...

9. CVE-2026-128022 FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests

   Published 2026-11-13

   Medium·CVSS 6.9 EPSS 0.42%

   FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleReq...

10. CVE-2026-128024 FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion

    Published 2026-11-13

    High·CVSS 8.2 EPSS 0.49%

    FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, tri...

11. CVE-2026-128023 FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing

    Published 2026-11-13

    Critical·CVSS 9.1 EPSS 0.51%

    FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that...

12. CVE-2026-128025 FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos

    Published 2026-11-13

    Medium·CVSS 6.9 EPSS 0.31%

    FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute...

13. CVE-2026-128026 FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv

    Published 2026-11-13

    Medium·CVSS 6.9 EPSS 0.13%

    FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the...

14. CVE-2026-122233 FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

    Published 2026-11-04

    Medium·CVSS 6.3 EPSS 0.23%

    FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_...

15. CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

    Published 2026-10-13

    High·CVSS 7.7 EPSS 0.29%

    FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuratio...

16. CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

    Published 2026-06-10

    High·CVSS 8.1 EPSS 0.71%

    FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an a...

17. CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files

    Published 2026-02-12

    High·CVSS 8.9 EPSS 0.64%

    FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that...

18. CVE-2026-24894 FrankenPHP leaks session data between requests in worker mode

    Published 2026-02-12

    High·CVSS 8.7 EPSS 0.49%

    FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previou...

19. GHSA-x9p2-77v6-6vhf FrankenPHP has delayed propagation of security fixes in upstream base images

    Published 2026-02-05

    Critical·CVSS 9.8

    Delayed propagation of security fixes in upstream base images Summary Vulnerability in base Docker images (PHP, Go, and Alpine) not automatically propagating to FrankenPHP images. FrankenPHP's container images were previously built only when specific version tags were updated or...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.