CVE-2026-128024: FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphplog() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it if they can cause crafted JSON to be passed to frankenphp_log() or returned from a worker callback. Exploitation requires arrays containing null elements with integer keys.
What is the operational impact of a successful attack?
The crafted input triggers an unrecovered cgo panic that terminates the FrankenPHP server process. This aborts every virtual host and all in-flight requests.
Which versions need remediation?
FrankenPHP versions before 1.13.0 are affected. Upgrading to 1.13.0 or later addresses the affected version range described in the advisory.