{"id":"CVE-2026-128014","kind":"vulnerability","aliases":["CVE-2026-128014"],"related":[],"title":"FrankenPHP: bundled Brotli decoder flaw lets crafted data crash or run code","description":"FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.","summary":"FrankenPHP standalone static binaries from 1.8.0 before 1.13.2 include a PHP brotli extension linked to Brotli 1.2.0, which has an out-of-bounds write in its decoder. An unauthenticated remote attacker can send crafted data to applications that pass it to brotli_uncompress_add(), crashing the FrankenPHP process and possibly leaking memory or running code.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","php","runtime","self-hosted"],"not_affected_if":["no-brotli-decompression","non-static-build","other-packaging"],"how_to_check":"- Run `frankenphp version` on each host and check whether it reports a version from `1.8.0` up to, but not including, `1.13.2`.\n- Check whether the application calls `brotli_uncompress_add()` on data it receives from outside.","fix":"- FrankenPHP standalone static binaries: `1.13.2`","status":"open","published_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:48:32+00:00","updated_at":"2026-11-13T10:48:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:48:32Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP standalone static binaries: `1.13.2`","reach":"internet","title":"FrankenPHP: bundled Brotli decoder flaw lets crafted data crash or run code","impact":"high","summary":"FrankenPHP standalone static binaries from 1.8.0 before 1.13.2 include a PHP brotli extension linked to Brotli 1.2.0, which has an out-of-bounds write in its decoder. An unauthenticated remote attacker can send crafted data to applications that pass it to brotli_uncompress_add(), crashing the FrankenPHP process and possibly leaking memory or running code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"process crash, possible memory disclosure or code execution","analyst_note":"Confirm the fixed-version range and whether non-static FrankenPHP builds are affected; check the vendor advisory on github.com for details.","how_to_check":"- Run `frankenphp version` on each host and check whether it reports a version from `1.8.0` up to, but not including, `1.13.2`.\n- Check whether the application calls `brotli_uncompress_add()` on data it receives from outside.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-brotli-decompression","other-packaging","non-static-build"],"who_is_affected":"Only standalone static FrankenPHP binaries in the 1.8.0 to 1.13.2 range are affected, since they bundle the statically linked brotli extension. Exposure requires an application that passes untrusted input to brotli_uncompress_add(); applications that do not decode Brotli from outside sources are less exposed. Servers that use other FrankenPHP packaging or do not decompress Brotli data from clients can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000808,"input_tokens":4655,"output_tokens":686,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111497':109C '-128014':15A,18A '-2026':14A,17A,108C '1.13.2':32B,87C '1.2.0':41B,97C '1.8.0':30B,85C 'add':69B,125C 'applic':62B,118C 'attack':56B,112C 'binari':28B,84C 'bound':48B,105C 'brot':3A,36B,40B,67B,91C,96C,123C 'bundl':2A,88C 'caus':134C 'code':12A,80B,138C 'contain':100C 'craft':7A,59B,115C 'crash':9A,70B,127C 'cve':13A,16A,107C 'data':8A,60B,116C 'decod':4A,52B,99C 'disclosur':136C 'entir':129C 'execut':139C 'extens':37B,92C 'flaw':5A 'frankenphp':1A,19B,25B,72B,81C,130C 'host':24B 'includ':33B 'leak':76B 'let':6A 'link':38B,94C 'memori':77B,135C 'out-of-bound':45B,102C 'pass':64B,120C 'php':20B,35B,90C 'possibl':75B,133C 'process':73B,131C 'remot':55B,111C 'run':11A,79B 'runtim':21B 'self':23B 'self-host':22B 'send':58B,114C 'standalon':26B,82C 'static':27B,83C,93C 'unauthent':54B,110C 'uncompress':68B,124C 'whose':98C 'write':49B,106C","nicknames":[],"mitigations":[],"who_affected":"Only standalone static FrankenPHP binaries in the 1.8.0 to 1.13.2 range are affected, since they bundle the statically linked brotli extension. Exposure requires an application that passes untrusted input to brotli_uncompress_add(); applications that do not decode Brotli from outside sources are less exposed. Servers that use other FrankenPHP packaging or do not decompress Brotli data from clients can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","frankenphp","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128014':15A,18A '-2026':14A,17A 'brot':3A 'bundl':2A 'code':12A 'craft':7A 'crash':9A 'cve':13A,16A 'data':8A 'decod':4A 'flaw':5A 'frankenphp':1A 'let':6A 'run':11A","search_b":"'1.13.2':32B '1.2.0':41B '1.8.0':30B 'add':69B 'applic':62B 'attack':56B 'binari':28B 'bound':48B 'brot':36B,40B,67B 'code':80B 'craft':59B 'crash':70B 'data':60B 'decod':52B 'extens':37B 'frankenphp':19B,25B,72B 'host':24B 'includ':33B 'leak':76B 'link':38B 'memori':77B 'out-of-bound':45B 'pass':64B 'php':20B,35B 'possibl':75B 'process':73B 'remot':55B 'run':79B 'runtim':21B 'self':23B 'self-host':22B 'send':58B 'standalon':26B 'static':27B 'unauthent':54B 'uncompress':68B 'write':49B","search_c":"'-111497':109C '-2026':108C '1.13.2':87C '1.2.0':97C '1.8.0':85C 'add':125C 'applic':118C 'attack':112C 'binari':84C 'bound':105C 'brot':91C,96C,123C 'bundl':88C 'caus':134C 'code':138C 'contain':100C 'craft':115C 'crash':127C 'cve':107C 'data':116C 'decod':99C 'disclosur':136C 'entir':129C 'execut':139C 'extens':92C 'frankenphp':81C,130C 'link':94C 'memori':135C 'out-of-bound':102C 'pass':120C 'php':90C 'possibl':133C 'process':131C 'remot':111C 'send':114C 'standalon':82C 'static':83C,93C 'unauthent':110C 'uncompress':124C 'whose':98C 'write':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T16:53:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128014","severity":null,"published_at":"2026-11-13T10:18:06+00:00","modified_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145323,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-p746-jj3f-94p8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T16:53:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145324,"url":"https://www.vulncheck.com/advisories/frankenphp-1.8.0-before-1.13.2-out-of-bounds-write-via-bundled-brotli-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}