CVE-2026-128014 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP standalone static binaries from 1.8.0 before 1.13.2 include a PHP brotli extension linked to Brotli 1.2.0, which has an out-of-bounds write in its decoder. An unauthenticated remote attacker can send crafted data to applications that pass it to brotli_uncompress_add(), crashing the FrankenPHP process and possibly leaking memory or running code.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only standalone static FrankenPHP binaries in the 1.8.0 to 1.13.2 range are affected, since they bundle the statically linked brotli extension. Exposure requires an application that passes untrusted input to brotli_uncompress_add(); applications that do not decode Brotli from outside sources are less exposed. Servers that use other FrankenPHP packaging or do not decompress Brotli data from clients can skip it.
Not affected if no-brotli-decompression, non-static-build, other-packaging
Who cares frankenphp, php, self-hosted
frankenphp version on each host and check whether it reports a version from 1.8.0 up to, but not including, 1.13.2.brotli_uncompress_add() on data it receives from outside.1.13.2FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.