php/frankenphp v1.12.5

on GitHub

FrankenPHP 1.12.5 is a security release. It fixes two disclosed vulnerabilities — an information leak in the default Docker welcome page and a cross-request session ID leak in worker mode — plus a batch of crash and hang fixes in worker mode and the CGI layer. Every user should upgrade, especially anyone running the official Docker images or the session extension as a shared module.

🔒 Security & Hardening

• Docker images no longer serve phpinfo() by default. The default /app/public/index.php ran phpinfo(), so any derived image that didn't ship its own index leaked environment variables (often holding secrets), php.ini directives, versions, and system paths. Both the Debian and Alpine images now ship the same static, script-free welcome page used by the RPM/deb packages by @dunglas in #2524. See GHSA-cj57-c655-p798.
• Session ID no longer leaks across worker requests when the session extension is a shared module. PS(id) wasn't reset between requests when HAVE_PHP_SESSION was undefined at compile time, so session_start() could reuse the previous request's session id and hand one client another client's session. Statically-linked builds were unaffected by @dunglas in #2523. See GHSA-v3ph-cgqh-r8p5.
• Slow-POST protection by default. A client that stalls a request body indefinitely used to hold a PHP thread for the life of the connection, exhausting the thread pool under max_threads. php_server/php deployments now enforce a 60s idle timeout on body reads out of the box (matching nginx's client_body_timeout), configurable via the new request_body_timeout directive or 0 to disable. Library users get the same control via WithRequestBodyTimeout by @iliaal in #2465.

🐛 Fixes

• Fix a heap-buffer-overflow read when parsing a short header("HTTP/...") status line by assuming the code from PHP's own sapi_update_response_code() instead of reparsing it by @iliaal in #2464.
• Guard against a panic (and process crash) from a malformed RemoteAddr when stripping IPv6 brackets in server variable registration by @iliaal in #2463, and a related panic on malformed RemoteAddr in the CGI variable builder by @alexandre-daubois in #2484.
• Fix queued requests getting stuck on replaced channels by reusing created-once channels by @henderkes in #2470.
• Fix long-running CLI scripts hanging when a pcntl signal reached the Go runtime instead of the PHP handler by @henderkes in #2445.
• Fix hanging reboots on threads that were upscaled and then downscaled by @AlliBalliBaba in #2510, following up on the thread-reboot-on-opcache_reset/watcher-change fix by @AlliBalliBaba in #2364.
• Deduplicate registration-time duplicates produced by match directives by @henderkes in #2487.
• php_server's environment variables are now available in the sandboxed environment by @henderkes in #2451.
• extgen: correct a C parameter cast in generated class method wrapper calls by @alexandre-daubois in #2436.

⚡ Performance Improvements

• Fold a 3-instruction TLS load into a single mrs on aarch64 by @henderkes in #2512.

📖 Documentation

• Add guides for deploying on macOS and Windows by @m-this.
• Document pcov and imagick incompatibilities in known issues by @alexandre-daubois in #2492.
• Chinese translations for logging and observability docs by @pierresh in #2515.
• Italian translation of the docs by @garak in #2405.

💖 New Contributors

• @iliaal made their first contribution in #2464.
• @m-this made their first contribution in #2502.
• @garak made their first contribution in #2405.

Need help hardening a worker-mode deployment against session leaks and slow-POST DoS, or auditing your Docker images before they ship secrets to the public? Les-Tilleuls.coop — the team behind FrankenPHP — provides professional support, consulting, custom development, and training. Get in touch: contact@les-tilleuls.coop.

Full Changelog: v1.12.4...v1.12.5