CVE-2026-128015

CVSS 8.3 (high) · published 2026-11-13

FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.

Weakness: CWE-416

Source: NVD CVE-2026-128015

References

• https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e
• https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf
• https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.