CVE-2026-128015 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.4 frees an environment table during request shutdown but keeps a pointer to it, so a later putenv() or getenv() call can use freed memory. An attacker who can trigger putenv() in shutdown functions, destructors or session handlers can crash the process or read environment values left over from a previous request.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications running FrankenPHP below 1.13.4 that call putenv() during request shutdown, in shutdown functions, destructors or session handlers, are exposed. Teams running other PHP servers or FrankenPHP at 1.13.4 or later can skip it.
Not affected if fixed-version, no-putenv-in-shutdown
Who cares frankenphp, kubernetes, php, self-hosted
frankenphp version or the binary used in the container image.github.com/dunglas/frankenphp) and confirm whether the version is below 1.13.4.1.13.4 or later.FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.