GHSA-3wfj-qwvc-xxr4HighCVSS 5.9

FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array...

Published
November 13, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (1)

📋 Description

FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.

🔗 References (4)