Use-After-Free Vulnerability in FrankenPHP by PHP
CVE-2026-128016

8.3HIGH

Key Information:

Vendor

PHP
Status
FrankenPHP
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128016?

FrankenPHP prior to version 1.13.4 is susceptible to a use-after-free vulnerability in its worker mode. This flaw occurs when internal streams of SplTempFileObject or SplFileObject that interact with php://temp instances are incorrectly freed and persist across requests. Attackers can exploit this vulnerability by sending specially crafted requests, leading to the potential reading of freed memory. This can result in a leak of garbage data or cause the application process to crash, adversely impacting system stability.

Affected Version(s)

frankenphp 0 < 1.13.4

frankenphp 1.13.4

References

https://github.com/php/frankenphp/security/advisories/GHS...
vendor-advisory
https://github.com/php/frankenphp/commit/837b76880b33a1a7...
patch
https://www.vulncheck.com/advisories/frankenphp-before-1....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

atarus-security
.