---
id: "CVE-2026-128027"
page: "https://infrastack.ai/live/CVE-2026-128027"
kind: "vulnerability"
aliases: ["CVE-2026-128027"]
title: "FrankenPHP Docker images stale base layers let remote attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "frankenphp", "fixed": ["1.1.11"], "affected": "< 1.1.11", "ecosystem": "docker"}]
ecosystems: []
tags: ["docker", "frankenphp", "php", "runtime", "self-hosted"]
not_affected_if: ["own-image-build", "version-1.1.11-or-later"]
published_at: "2026-11-13T10:18:08+00:00"
first_seen_at: "2026-11-13T10:47:31+00:00"
updated_at: "2026-11-13T10:48:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128027", "first_seen_at": "2026-11-13T10:47:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:48:54+00:00"}]
exploit_sources: []
---

# FrankenPHP Docker images stale base layers let remote attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-128027 (this .md is for agents)

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags appeared, so security fixes shipped by Alpine, PHP and Go under existing tags never reached them. Remote attackers can exploit known flaws in the outdated system libraries inside these images, such as CVE-2025-15467 in libcrypto3, to execute code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- docker:frankenphp affected < 1.1.11 fixed 1.1.11

## How to check

- Run docker image inspect <image> and check the Created date. An image pulled or built before Feb 4 2026 may carry stale Alpine libraries.
- Run docker run --rm <image> apk info -v libcrypto3 and compare with the patched Alpine releases (3.20.9, 3.21.6, 3.22.3, 3.23.3 per the advisory).
- Check which FrankenPHP version/tag your Dockerfile or compose file uses; the advisory lists <1.1.11 as affected.
- If you build FROM dunglas/frankenphp, rebuild with --pull.

## Fix

Pull the current image for your FrankenPHP tag (docker pull dunglas/frankenphp:<tag>) and rebuild derived images with docker build --pull. Since Feb 4 2026 the project rebuilds images daily when the Alpine, PHP or Go base digest changes. Advisory lists affected as <1.1.11.

## Timeline

- 2026-11-13T10:47:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128027
- 2026-11-13T10:48:54+00:00 analyst — Read GHSA-x9p2-77v6-6vhf and VulnCheck. Cause is a CI staleness gap, fixed Feb 4 2026 by daily digest checks; advisory gives no patch version beyond affected <1.1.11. Triage's label-compare check replaced. No exploitation or PoC checked; social not searched.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frankenphp-before-1.1.11-delayed-propagation-of-base-image-security-fixes

## From the sources

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_