CVE-2026-128024 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.0 has a denial-of-service flaw in its goArray() conversion, where arrays with null integer-keyed elements cause an unrecovered cgo panic. A remote attacker who sends crafted JSON passed to frankenphp_log() or returned from worker callbacks can abort the whole server process, dropping every vhost and in-flight request.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
FrankenPHP servers below 1.13.0 that pass request-derived JSON into frankenphp_log() or return it from worker callbacks are exposed. Servers that do not use worker mode or that never feed untrusted JSON into those paths are less likely to be reached. The sources do not say whether default configurations are affected in every case.
Not affected if fixed-version, no-worker-mode
Who cares frankenphp, kubernetes, php, self-hosted
frankenphp version or the binary used in your image; versions below 1.13.0 are in range.frankenphp_log() or return arrays from FrankenPHP worker callbacks using decoded JSON from request input.1.13.0 or later.FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.