CVE-2026-128017
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.