FrankenPHP Files

FrankenPHP 1.13.4 is a security release. It fixes 7 vulnerabilities in FrankenPHP, including a high-severity one that let a single unauthenticated request crash the whole process in worker mode, and several cross-request leaks and memory safety issues in worker mode. Docker images and Windows builds now ship a Brotli library patched against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are now built with Go 1.27.3, which fixes vulnerabilities in the Go standard library. Upgrading is strongly recommended.

🔒 Security

• High, worker mode: A client that sent a header name FrankenPHP hadn't seen recently and reset the connection before the request was handled crashed the whole process. Only 1.13.2 and 1.13.3 are affected (GHSA-5f4m-ff4w-g458).
• Use-after-free: A putenv() call from a shutdown function, a destructor or a session handler left a dangling pointer, and the next script on the thread crashed the process or read the previous request's value on its first getenv() (GHSA-rgpj-f2qx-xwhf).
• Use-after-free, worker mode: An SplTempFileObject (or SplFileObject on php://temp) kept across requests, on purpose or in uncollected garbage, had its stream freed at the start of the next request (GHSA-cm3q-jw2q-9rh5).
• Worker mode: Per-request environment variables (Caddy env with request placeholders, route-specific env blocks, WithRequestEnv()) leaked into later requests through getenv() and $_SERVER. $_ENV now only contains the worker's environment (GHSA-8386-64gm-3m8q).
• Worker mode: http_get_last_response_headers(), strtok() and the URL rewriter variables are now reset between requests. Before this fix, a request could read the upstream response headers fetched by a previous one (GHSA-pmvg-8483-mw84).
• Worker mode: A worker script ending its own loop right after a JSON or other non-form POST freed the same pointer twice. It only had a visible effect with USE_ZEND_ALLOC=0 (GHSA-h764-4wh7-m7j2).
• Worker mode: A fatal error during worker request startup left the dequeued request waiting forever (GHSA-x6j6-qv7w-fq3c).
• Brotli, CVE-2026-111497 (Node2Shell): Docker images ship a patched Brotli: the distribution's security update on Debian Trixie and Alpine, and Brotli 1.2.1 built from source on Debian Bookworm. Windows builds ship Brotli 1.2.1, including the library used by PHP's curl extension. Static binaries have bundled Brotli 1.2.1 since 1.13.2 (GHSA-p746-jj3f-94p8) by @dunglas in #2767, #2777 and #2782.
• Go: Windows and macOS binaries were built with Go 1.27.0, which is affected by several standard library vulnerabilities, including an HTTP/2 server crash (GO-2026-6617). All release binaries are now built with the latest Go patch release, 1.27.3 by @dunglas in #2776.

FrankenPHP has also been selected for Anthropic's OSS Scanner program, which regularly scans the project for vulnerabilities ([anthropics/oss-scanner#1067](https://github.com/anthropics/oss-scanner/issues/1067)).

🐛 Bug Fixes

• Embed: php-cli now runs extension-less scripts of the embedded app, so ./my-app php-cli bin/console works as documented by @dunglas in #2765.
• Static builds: Release builds now push the static-builder-{musl,gnu}-{version} image tags, which 1.13.3 didn't by @strikerz5 in #2758.
• PHP 8.6: Restore compatibility with the development branch by @henderkes in #2770.
• Upgrade to Mercure 1.1.5 by @dunglas in #2768.

⚡ Performance Improvements

• Worker mode: Avoid an allocation per request when deriving SCRIPT_NAME for explicitly assigned workers by @andreybolonin in #2755.
• Worker mode: Avoid buffering output written while a worker starts by @andreybolonin in #2756.

📖 Documentation

• Document umask() and setlocale() as process-wide state that persists across worker requests and affects concurrent requests by @dunglas in #2779.
• Update translations in #2769 and #2780.

💖 New Contributors

• @andreybolonin made their first contribution in #2755
• @strikerz5 made their first contribution in #2758
• @opctim made their first contribution in #2729

Full Changelog: https://github.com/php/frankenphp/compare/v1.13.3...v1.13.4