CVE-2026-128014
Deferred Deferred - Pending Action

FrankenPHP Static Binaries Brotli Decoder Out-of-Bounds Write

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128014
EUVD
EUVD-2026-125088

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frankenphp frankenphp to 1.13.2 (exc)
brotli brotli 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in the Brotli decoder (CVE-2026-111497) bundled with FrankenPHP static binaries versions 1.8.0 to 1.13.1. Attackers can send crafted data to the brotli_uncompress_add() function, crashing the entire FrankenPHP process. While memory disclosure or code execution is theoretically possible, it was not demonstrated. The issue is patched in versions 1.13.2 and later.

Detection Guidance

Check FrankenPHP version with 'frankenphp -v' or 'php -v'. If using static binaries between 1.8.0 and 1.13.1, the system is vulnerable. Inspect loaded PHP extensions for 'brotli' using 'php -m' or 'php -r "print_r(get_loaded_extensions());"'.

Impact Analysis

Unauthenticated remote attackers can crash your FrankenPHP application with a single request, causing downtime. If exploited further, it may lead to memory disclosure or arbitrary code execution. Systems processing user-uploaded or fetched Brotli-compressed data are most at risk.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or unauthorized data access, potentially violating availability and confidentiality requirements in GDPR and HIPAA. Downtime or data breaches may lead to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.2 or later. If using Docker, ensure version 1.13.4 or newer. Remove or disable the Brotli extension if not required. Monitor for crashes in FrankenPHP processes as potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...