CVE-2026-128017: FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST
FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(requestinfo).contenttypedup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USEZENDALLOC=0 is set.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to process termination?
Deployments running FrankenPHP before 1.13.4 in worker mode are exposed when USE_ZEND_ALLOC=0 is set. The issue is triggered after a non-form POST request, such as a JSON POST, when the worker script ends its loop.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can repeatedly send JSON POST requests; no user interaction is required.
What is the operational impact of a successful attack?
The double free can abort the entire process when USE_ZEND_ALLOC=0 is set, causing an availability impact.