FrankenPHP 1.13.4 Fixes Seven Flaws, Including Worker-Mode Crash

Maintainers of FrankenPHP released version 1.13.4 on 26 October 2026 to fix seven security vulnerabilities in the PHP application server. According to the release notes, the most severe issue could allow a single unauthenticated request to crash the entire server process in worker mode, potentially interrupting requests from other users.

The high-severity vulnerability affects only versions 1.13.2 and 1.13.3. It occurs when a client sends an HTTP header name the server has not encountered recently and closes the connection before the request is handled. The remaining fixes address memory-safety problems, requests left waiting after worker startup failures and information retained between requests. These include cases where request-specific environment variables or upstream HTTP response headers could become accessible to later requests. The maintainers state that, apart from the header-related crash, the vulnerabilities are not exploitable in common configurations, including typical Symfony and Laravel applications. They require specific application code or advanced, non-default settings.

Separate from the seven FrankenPHP vulnerabilities, the release also addresses security issues in bundled dependencies. Docker images and Windows builds now include Brotli fixes for CVE-2026-111497, known as Node2Shell. The Docker images use patched Brotli packages or version 1.2.1, depending on the base distribution, while Windows builds include Brotli 1.2.1. Static binaries have included the patched version since FrankenPHP 1.13.2. Windows and macOS binaries are also built with Go 1.27.3 to address standard-library vulnerabilities, including an HTTP/2 server crash. The maintainers strongly recommend upgrading.

The release is relevant to Drupal deployments using FrankenPHP, although the affected execution modes require distinction. Drupal 11.4 introduced Symfony Runtime integration, separating aspects of application bootstrapping from request handling and creating a foundation for compatibility with alternative application servers. However, the change did not complete the work required for persistent worker processes. An ongoing Drupal core issue identifies remaining problems involving repeated kernel execution and request-specific state that can persist between requests. FrankenPHP can serve Drupal in conventional mode, but persistent-worker compatibility remains under development.

Drupal administrators using FrankenPHP should check their installed versions and server configurations against the upstream advisories. The worker-mode crash does not establish a vulnerability in Drupal core, and the other issues depend on their specific triggering conditions. The release also includes bug fixes, worker-mode performance improvements and documentation updates. FrankenPHP maintainers have separately announced the project's inclusion in Anthropic's OSS Scanner programme, which provides ongoing vulnerability scanning for selected open-source projects.