CVE-2026-128016 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.4 frees internal streams of SplTempFileObject or SplFileObject on php://temp objects that survive across requests in worker mode. Remote requests that reach code using those persisted objects read freed memory, leaking garbage data or crashing the process.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only FrankenPHP deployments running in worker mode are exposed, where application objects persist across requests. Standard request-per-process setups are not described as affected. Teams not using worker mode can skip it.
Not affected if non-frankenphp-php, worker-mode-disabled
Who cares frankenphp, php, self-hosted, worker-mode
1.13.4SplFileObject or SplTempFileObject instances using php://temp1.13.4 or laterFrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.