---
id: "CVE-2026-128015"
page: "https://infrastack.ai/live/CVE-2026-128015"
kind: "vulnerability"
aliases: ["CVE-2026-128015"]
title: "FrankenPHP: putenv during shutdown lets requests crash the process or leak data"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["frankenphp", "kubernetes", "php", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "no-putenv-in-shutdown"]
published_at: "2026-11-13T10:18:06+00:00"
first_seen_at: "2026-11-13T10:47:30+00:00"
updated_at: "2026-11-13T10:51:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128015", "first_seen_at": "2026-11-13T10:47:30+00:00"}]
exploit_sources: []
---

# FrankenPHP: putenv during shutdown lets requests crash the process or leak data

Link for people: https://infrastack.ai/live/CVE-2026-128015 (this .md is for agents)

FrankenPHP before 1.13.4 frees an environment table during request shutdown but keeps a pointer to it, so a later putenv() or getenv() call can use freed memory. An attacker who can trigger putenv() in shutdown functions, destructors or session handlers can crash the process or read environment values left over from a previous request.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FrankenPHP version with `frankenphp version` or the binary used in the container image.
- Look for FrankenPHP in the deployed image or go.mod (`github.com/dunglas/frankenphp`) and confirm whether the version is below `1.13.4`.

## Fix

- FrankenPHP: move to `1.13.4` or later.

## Timeline

- 2026-11-13T10:47:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128015

## Documents

- [advisory] Vendor advisory: github.com https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown
- [fix] Patch: github.com https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e

## From the sources

FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_