CVE-2026-128027: FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes
FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.11
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using FrankenPHP Docker images earlier than 1.1.11 are affected if their images retained stale Alpine, PHP, Go, or other base-image libraries whose fixes were published under an existing base-image tag.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-accessible exploitation with low attack complexity, no privileges, and no user interaction; exploitation depends on a reachable vulnerable component in the stale image.
What should teams do if they cannot immediately move to 1.1.11?
Rebuild or replace affected Docker images so they incorporate current security fixes from their base images. Prioritize images containing known vulnerable libraries, including libcrypto3 affected by CVE-2025-15467.
How can teams determine whether an image is affected?
Check whether the deployed FrankenPHP Docker image version is earlier than 1.1.11, then inspect the image for stale base-image packages and known vulnerable library versions. The issue arises when an image was not rebuilt after Alpine, PHP, or Go fixes were made available under an unchanged tag.