CVE-2026-128018 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.4 can leave a client request unfinished when a worker script hits a fatal error during request startup, because frankenphp_handle_request() returns false without completing the dequeued request. An attacker who triggers those startup fatals can make client requests hang indefinitely while the worker keeps running.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications running FrankenPHP in worker mode, where a long-lived PHP worker script calls frankenphp_handle_request() repeatedly. Servers that run FrankenPHP without worker mode, or that do not run FrankenPHP at all, are not affected by this description.
Not affected if default-config, no-worker-mode
Who cares frankenphp, php, self-hosted, worker-mode
frankenphp version.php_server with a worker directive.1.13.4 or later.FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphp_handle_request() can leave client requests hanging indefinitely while the worker continues running.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.