CVE-2026-128015

EUVD-2026-125087
FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.87%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
phpfrankenphp
𝑥
< 1.13.4
CNA
Common Weakness Enumeration
References
https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e
https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf
https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown