FrankenPHP 1.13.4 is a security release. It fixes 7 vulnerabilities in FrankenPHP, including a high-severity one that let a single unauthenticated request crash the whole process in worker mode, and several cross-request leaks and memory safety issues in worker mode. Docker images and Windows builds now ship a Brotli library patched against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are now built with Go 1.27.3, which fixes vulnerabilities in the Go standard library. Upgrading is strongly recommended.
🔒 Security
- High, worker mode: A client that sent a header name FrankenPHP hadn't seen recently and reset the connection before the request was handled crashed the whole process. Only 1.13.2 and 1.13.3 are affected (GHSA-5f4m-ff4w-g458).
- Use-after-free: A
putenv()call from a shutdown function, a destructor or a session handler left a dangling pointer, and the next script on the thread crashed the process or read the previous request's value on its firstgetenv()(GHSA-rgpj-f2qx-xwhf). - Use-after-free, worker mode: An
SplTempFileObject(orSplFileObjectonphp://temp) kept across requests, on purpose or in uncollected garbage, had its stream freed at the start of the next request (GHSA-cm3q-jw2q-9rh5). - Worker mode: Per-request environment variables (Caddy
envwith request placeholders, route-specificenvblocks,WithRequestEnv()) leaked into later requests throughgetenv()and$_SERVER.$_ENVnow only contains the worker's environment (GHSA-8386-64gm-3m8q). - Worker mode:
http_get_last_response_headers()no longer returns the upstream response headers fetched by a previous request (GHSA-pmvg-8483-mw84). As hardening, thestrtok()state and the URL rewriter variables are also reset between requests, as PHP does at the end of a script, although PHP doesn't document them as request-scoped. - Worker mode: A worker script ending its own loop right after a JSON or other non-form
POSTfreed the same pointer twice. It only had a visible effect withUSE_ZEND_ALLOC=0(GHSA-h764-4wh7-m7j2). - Worker mode: A fatal error during worker request startup left the dequeued request waiting forever (GHSA-x6j6-qv7w-fq3c).
- Brotli, CVE-2026-111497 (Node2Shell): Docker images ship a patched Brotli: the distribution's security update on Debian Trixie and Alpine, and Brotli 1.2.1 built from source on Debian Bookworm. Windows builds ship Brotli 1.2.1, including the library used by PHP's curl extension. Static binaries have bundled Brotli 1.2.1 since 1.13.2 (GHSA-p746-jj3f-94p8) by @dunglas in #2767, #2777 and #2782.
- Go: Windows and macOS binaries were built with Go 1.27.0, which is affected by several standard library vulnerabilities, including an HTTP/2 server crash (GO-2026-6617). All release binaries are now built with the latest Go patch release, 1.27.3 by @dunglas in #2776.
Apart from the header crash, which was introduced in 1.13.2 by a change in a dependency, none of the FrankenPHP vulnerabilities fixed in this release were exploitable in common setups, including Symfony and Laravel apps. Triggering them requires specific application code, such as calling putenv() from a shutdown function, or advanced, non-default configuration, such as using request-specific Caddy placeholders in env directives.
FrankenPHP has also been selected for Anthropic's OSS Scanner program, which regularly scans the project for vulnerabilities (anthropics/oss-scanner#1067).
🐛 Bug Fixes
- Embed:
php-clinow runs extension-less scripts of the embedded app, so./my-app php-cli bin/consoleworks as documented by @dunglas in #2765. - Static builds: Release builds now push the
static-builder-{musl,gnu}-{version}image tags, which 1.13.3 didn't by @strikerz5 in #2758. - PHP 8.6: Restore compatibility with the development branch by @henderkes in #2770.
- Upgrade to Mercure 1.1.5 by @dunglas in #2768.
⚡ Performance Improvements
- Worker mode: Avoid an allocation per request when deriving
SCRIPT_NAMEfor explicitly assigned workers by @andreybolonin in #2755. - Worker mode: Avoid buffering output written while a worker starts by @andreybolonin in #2756.
📖 Documentation
- Document
umask()andsetlocale()as process-wide state that persists across worker requests and affects concurrent requests by @dunglas in #2779. - Update translations in #2769 and #2780.
💖 New Contributors
- @andreybolonin made their first contribution in #2755
- @strikerz5 made their first contribution in #2758
- @opctim made their first contribution in #2729
Full Changelog: v1.13.3...v1.13.4