CVE-2026-128017

LOW 3.7

FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

CWE	CWE-415
Vendor	php
Product	frankenphp
Ecosystems	PHP Web
Industries	Technology
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for php frankenphp

Be the first to know when new low vulnerabilities affecting php frankenphp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

php / frankenphp

0 < 1.13.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/php/frankenphp/security/advisories/GHSA-h764-4wh7-m7j2 github.com: https://github.com/php/frankenphp/commit/8777cc2e5c872ebb869fa2b5f972a913648621e8 vulncheck.com: https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-double-free-in-worker-mode-via-non-form-post

Credits

🔍 atarus-security