CVE-2026-128020 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.2 does not detect self-referential PHP arrays when converting them to Go values, so passing one to frankenphp_log() or returning one from a worker callback causes a fatal Go stack overflow. An attacker who can get such a request through terminates the entire server process, a denial of service.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any application running FrankenPHP before 1.13.2 that passes PHP arrays into frankenphp_log() or returns arrays from worker callbacks can be crashed by a request that produces a self-referential array. Applications on a patched version, or that never use these paths with array data, are not affected.
Not affected if no-worker-mode, patched-version
Who cares frankenphp, go, php, self-hosted
frankenphp version or the binary your server runsfrankenphp_log() and worker callbacks that return arrays built from user input1.13.2FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.