FRANKENPHP · CVE-2026-128027 · Runtime
FIX → 1.1.11 ✓ verified
FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags appeared, so security fixes shipped by Alpine, PHP and Go under existing tags never reached them. Remote attackers can exploit known flaws in the outdated system libraries inside these images, such as CVE-2025-15467 in libcrypto3, to execute code.
first public Feb 5, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running the official dunglas/frankenphp Docker images, or images built FROM them, that were pulled or built before the Feb 4 2026 pipeline fix. The images kept old Alpine, PHP and Go layers after upstream patched them under the same tag, so system libraries such as libcrypto3 (CVE-2025-15467) stayed vulnerable. Skip it if you already pulled a current image or build your own from fresh base images.
Not affected if own-image-build, version-1.1.11-or-later
Who cares docker, frankenphp, php, self-hosted
Upgrade to 1.1.11
FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.1.11