FRANKENPHP · CVE-2026-128017 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.4 frees the same request content-type buffer twice in worker mode after a non-form POST request ends a worker loop. An unauthenticated attacker can send repeated JSON POST requests to abort the whole process when USE_ZEND_ALLOC=0 is set.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running FrankenPHP before 1.13.4 in worker mode that accept JSON POST requests from the internet are exposed. The crash path needs USE_ZEND_ALLOC=0 to be set, so deployments with the default allocator are less exposed. Sites not running FrankenPHP workers can skip it.
Not affected if default-config, no-worker-mode
Who cares frankenphp, php, self-hosted, worker-mode
frankenphp version and compare it against 1.13.4.USE_ZEND_ALLOC=0 is set in the environment.1.13.4 or later.FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.