CVE-2026-128014

Name of the Vulnerable Software and Affected Versions FrankenPHP versions 1.8.0 through 1.13.1

Description Standalone static binaries bundle the PHP brotli extension statically linked with Brotli 1.2.0. The decoder in this version contains an out-of-bounds write, which occurs when an unauthenticated remote attacker sends crafted data to applications that pass it to the brotli uncompress add() function. This can lead to a crash of the entire process, memory disclosure, or remote code execution.

Recommendations Update to version 1.13.2.