CVE-2026-128016: FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode
FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FrankenPHP deployments running a version before 1.13.4 are exposed when worker mode is used and application code retains SplTempFileObject or SplFileObject objects backed by php://temp across requests.
What must an attacker do to exploit this issue?
A remote client must send requests that reach application code using one of the affected persisted objects. No authentication or user interaction is required, but exploitation has high attack complexity.
What is the likely impact?
Using the freed stream can cause reads of freed memory, potentially disclosing garbage data, or crash the FrankenPHP process, creating a denial-of-service condition.
How can I determine whether my application is affected?
Check whether FrankenPHP is running before version 1.13.4 with worker mode enabled, then review code for SplTempFileObject or SplFileObject instances on php://temp that survive and are reused across requests.
What can be done if upgrading is not immediately possible?
Avoid retaining or reusing affected SplTempFileObject and php://temp-backed SplFileObject instances across requests, or disable worker mode where feasible.