CVE-2026-128022 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.2 keeps executing queued requests after the client has disconnected. An unauthenticated attacker can send many requests and close connections at once, tying up the shared PHP thread pool and delaying other clients.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any service that exposes a FrankenPHP server to clients, especially to the internet, is in scope. Low-traffic internal tools with trusted clients are less exposed. unknown whether the sources list specific configurations beyond this.
Not affected if fixed-version, internal-only
Who cares frankenphp, php, self-hosted
frankenphp version or the version in your build or container image.1.13.2 or later.FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.