CVE-2026-128018
Deferred Deferred - Pending Action

FrankenPHP Worker Mode Denial of Service via Fatal Error

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphp_handle_request() can leave client requests hanging indefinitely while the worker continues running.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128018
EUVD
EUVD-2026-125084

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frankenphp frankenphp to 1.13.4 (exc)
php frankenphp to 1.13.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.13.4 has a denial of service vulnerability in worker mode. When a fatal error occurs during request startup, frankenphp_handle_request() returns false without completing the request. Attackers can trigger startup errors in worker scripts that keep calling this function, causing client requests to hang indefinitely while the worker continues running.

Detection Guidance

To detect this vulnerability, check if your system is running FrankenPHP versions before 1.13.4. Use commands like 'frankenphp -v' or inspect package managers for version details. Monitor worker processes for hanging requests or unexpected behavior during startup.

Impact Analysis

This vulnerability can lead to denial of service by causing client requests to hang indefinitely. Attackers may exploit it to degrade service availability for legitimate users. Systems using FrankenPHP in worker mode before version 1.13.4 are at risk.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.4 or later immediately. If upgrading is not possible, modify worker scripts to stop execution when frankenphp_handle_request() returns false, as recommended in the worker mode documentation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...