CVE-2026-128018: FrankenPHP before 1.13.4 Pending Worker Request Denial of Service
FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphphandlerequest() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphphandlerequest() can leave client requests hanging indefinitely while the worker continues running.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running FrankenPHP before 1.13.4 in worker mode are affected when their worker scripts continue calling frankenphp_handle_request(). The issue concerns requests that encounter a fatal error during request startup.
What does an attacker need to do to exploit it?
An attacker must be able to trigger a fatal error during request startup against an affected worker script. No privileges or user interaction are required according to the provided vector, but the attack complexity is high.
What is the impact if exploitation succeeds?
The dequeued client request can remain hanging indefinitely while the worker continues running. The reported impact is availability loss only; no confidentiality or integrity impact is identified.
What should be done to remediate the issue?
Upgrade FrankenPHP to version 1.13.4 or later. The provided data does not identify a configuration workaround for systems that cannot be upgraded immediately.