CVE-2026-128015: FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown
FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running FrankenPHP before 1.13.4 are affected. Exposure requires application code or a component that invokes putenv() during request shutdown.
What must an attacker be able to do to trigger the issue?
An attacker must be able to cause putenv() to run in a shutdown function, destructor, or session handler. A subsequent getenv() call can then crash the process or disclose environment values from a previous request.
What is the recommended remediation?
Upgrade FrankenPHP to version 1.13.4 or later. The provided information does not describe a configuration-only workaround.