← Database

CVE-2026-128020

MEDIUM CVSS: 5.9 Published: 2026-11-13 Modified: 2026-11-13

Description

FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.

Affected Platforms

Unknown

Weakness Type

CWE-674

References