Uncontrolled Recursion Vulnerability in FrankenPHP by FrankenPHP Team

CVE-2026-128020

What is CVE-2026-128020?

FrankenPHP, prior to version 1.13.2, is susceptible to an uncontrolled recursion vulnerability in its PHP-to-Go array converter. This flaw permits circular references within PHP arrays, leading to a situation where the function frankenphp_log() or callbacks returning self-referential arrays may cause a fatal stack overflow in the Go runtime. Such an event results in the termination of the entire server process, thereby posing a denial-of-service risk for applications relying on affected versions.

References