CVE-2026-128014: FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder
FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotliuncompressadd() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FrankenPHP standalone static binaries from 1.8.0 before 1.13.2 are affected because they statically bundle the PHP brotli extension with Brotli 1.2.0. Exposure requires an application to pass attacker-controlled crafted data to brotli_uncompress_add().
Does exploitation require authentication or user interaction?
No. The issue can be triggered by unauthenticated remote attackers when they can supply crafted data that reaches brotli_uncompress_add().
What is the likely impact if exploited?
Successful exploitation can crash the entire FrankenPHP process. The advisory also indicates possible memory disclosure or code execution.