CVE-2026-128020: FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion
FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphplog() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13.2
Event History
Frequently Asked Questions
Who can trigger the denial of service?
An unauthenticated remote attacker can trigger it where they can cause application code to pass a self-referential PHP array to frankenphp_log() or return one from a worker callback.
What is the impact on the affected service?
The cyclic-array conversion causes a fatal Go stack overflow that terminates the entire FrankenPHP server process, resulting in denial of service.
Which versions are affected?
FrankenPHP versions before 1.13.2 are affected.