External risk intelligence

FrankenPHP Brotli Out-of-Bounds Write Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-128014

FrankenPHP is a modern application server designed to serve web applications. As a web server technology intended to handle incoming requests, it is commonly deployed as an internet-facing service or an edge-facing component in web application stacks, making it highly plausible that the vulnerable Brotli decompression component would be reachable from the public internet in standard deployment configurations.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

FrankenPHP standalone binaries are affected by a vulnerability in a bundled PHP extension that could allow unauthenticated attackers to crash the application process, potentially leading to memory disclosure or code execution. The main concern is confirming relevance and exposure of this specific technology within our environment.

Crashes application by processing bad data.
A severe vulnerability impacting web server operations.
Assess if FrankenPHP is in use.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted data to a FrankenPHP application. This data is then processed by the vulnerable Brotli extension, leading to a crash of the entire FrankenPHP process, with potential for memory disclosure or code execution.

No authentication required.
Pass crafted data to brotli_uncompress_add().
Denial of service, memory disclosure, code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated remote attackers could crash the entire FrankenPHP process by sending crafted data to applications that pass it to `brotli_uncompress_add()`. This could potentially lead to memory disclosure or code execution.

FrankenPHP process crashes.
Crafted data sent to decompression function.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world impact from this vulnerability rests with teams managing web application infrastructure and the applications themselves. Identifying all FrankenPHP instances, confirming their exposure, and assessing their business criticality are the immediate first steps. This allows for prioritization and coordinated remediation, potentially involving application owners, infrastructure, and security teams.

Identify and confirm all FrankenPHP deployments.
Verify exposure and business criticality of instances.
Plan coordinated remediation with responsible teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FrankenPHP?

FrankenPHP is a modern, high-performance application server built to host web applications. It is unique because it is distributed as a standalone binary that includes the PHP interpreter and a web server in one package. By bundling components like the PHP Brotli extension directly into its static binary, it simplifies deployment but means that vulnerabilities in those included libraries—like the one found in the Brotli decoder—are built directly into the server's core execution environment.

What does CVE-2026-128014 mean for the Brotli extension?

This vulnerability is an out-of-bounds write, categorized as CWE-787. It occurs when software writes data past the intended end of a memory buffer. In this case, the flaw exists within the Brotli decompression library bundled with FrankenPHP. When the server processes malicious or malformed compressed data, the decoder mismanages memory, which can crash the entire application process or potentially allow an attacker to view sensitive memory or execute unauthorized code.

How is this FrankenPHP vulnerability triggered?

An attacker triggers this by sending specially crafted, compressed data to an application running on an affected version of FrankenPHP. The vulnerability specifically activates when the application passes this data to the `brotli_uncompress_add()` function for decompression. If the application does not receive or process data using this specific Brotli function, it is not susceptible to this specific trigger path.

Why is this CVE considered relevant for internet-facing systems?

According to Halo Surface Signal, FrankenPHP is frequently deployed as an edge-facing or internet-facing service to handle web traffic. Because this vulnerability does not require authentication to exploit, any FrankenPHP instance directly reachable from the public internet is at a higher risk of receiving crafted payloads from remote attackers. Identifying if your specific web services use these vulnerable binaries is essential for gauging actual reachability.

What should I do if I use FrankenPHP?

Your first step is to conduct an inventory to locate all instances of FrankenPHP within your infrastructure, as the vulnerability is tied to the bundled static binaries. Once identified, evaluate the business criticality and network exposure of these instances to prioritize your response. Coordinate with the relevant infrastructure and application teams to plan updates, as the fix involves moving to a version of FrankenPHP that includes a corrected, secure version of the Brotli decoder.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.