CVE-2026-128016

CVSS 8.3 (high) · published 2026-11-13

FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.

Weakness: CWE-416

Source: NVD CVE-2026-128016

References

• https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c
• https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5
• https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.