CVE-2026-128024

CVSS 8.2 (high) · published 2026-11-13

FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.

Weakness: CWE-248

Source: NVD CVE-2026-128024

References

• https://github.com/php/frankenphp/security/advisories/GHSA-4prg-hv4r-g6mv
• https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-denial-of-service-via-goarray-nil-type-assertion

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.