CVE-2026-128018
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphp_handle_request() can leave client requests hanging indefinitely while the worker continues running.