CVE-2026-128017
Deferred Deferred - Pending Action

Double Free Vulnerability in FrankenPHP Worker Mode

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128017
EUVD
EUVD-2026-125085

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frankenphp frankenphp to 1.13.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.13.4 has a double free vulnerability in worker mode. It frees the same memory twice when a worker script ends after handling a non-form POST request. Attackers can exploit this by sending repeated JSON POST requests until the worker loop ends, causing the process to abort if USE_ZEND_ALLOC=0 is set.

Detection Guidance

Detecting this vulnerability requires checking if FrankenPHP is running in worker mode with USE_ZEND_ALLOC=0 and monitoring for crashes after non-form POST requests. Check FrankenPHP version with frankenphp -v and inspect worker logs for repeated crashes.

Impact Analysis

This vulnerability can cause denial of service by crashing the FrankenPHP worker process. It may lead to service disruptions if the worker is critical for handling requests. Unauthorized code execution is unlikely but possible in specific memory allocation conditions.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.4 or later. If upgrading is not possible, disable worker mode or set USE_ZEND_ALLOC=1 to prevent the double free issue. Monitor for crashes and block repeated POST requests from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...