Repository navigation
v5.0.4
🔐 Security update: Brotli CVE-2026-111497 and FrankenPHP 1.13.4
Important
Pull and redeploy. The official PHP images ship a version of the Brotli library with an out-of-bounds write that can lead to remote code execution (CVE-2026-111497, also called Node2Shell). PHP's curl extension uses it, so every variation is affected. This release upgrades Brotli in every image. The FrankenPHP images also move to FrankenPHP 1.13.4, which fixes a crash that 1.13.2 (shipped in v5.0.3) introduced.
Note
These issues are in google/brotli and php/frankenphp upstream, not in this repo. PHP versions are the same as v5.0.3.
Brotli is patched in every image
| CVE | Issue | Fix |
|---|---|---|
| CVE-2026-111497 | Out-of-bounds write in the Brotli decoder that permits remote code execution | Brotli 1.1.1 and 1.2.1, plus distribution backports |
PHP reaches the Brotli decoder through curl when it decodes a Brotli-compressed response. A server your app calls could send one.
The official PHP images haven't been rebuilt with the fix yet. Our images now upgrade Brotli during the build:
| Base OS | Before | Now |
|---|---|---|
| Debian Bookworm | 1.0.9-2+b6 |
1.0.9-2+deb12u1 |
| Debian Trixie | 1.1.0-2+b7 |
1.1.0-2+deb13u1 |
| Alpine 3.23 and 3.24 | 1.2.0-r1 |
1.2.1-r0 |
| Alpine 3.22 (PHP 8.1) | 1.1.0-r2 |
1.1.1-r0 |
Alpine fixed 3.22 with Brotli 1.1.1. It hasn't added the CVE to that branch's security database yet, so vulnerability scanners may still flag the PHP 8.1 Alpine images until it does.
We'll drop this workaround once the official PHP images ship the fix.
🐘 FrankenPHP v1.13.4
FrankenPHP 1.13.4 is a security release. It fixes these issues in FrankenPHP itself:
| Advisory | Issue |
|---|---|
| GHSA-5f4m-ff4w-g458 | High. In worker mode, a single unauthenticated request could crash the whole process. Only 1.13.2 and 1.13.3 are affected. |
| GHSA-rgpj-f2qx-xwhf | Calling putenv() from a shutdown function, destructor, or session handler could crash the process or leak the previous request's value |
| GHSA-cm3q-jw2q-9rh5 | In worker mode, an SplTempFileObject kept across requests had its stream freed |
| GHSA-8386-64gm-3m8q | In worker mode, per-request environment variables leaked into later requests |
| GHSA-pmvg-8483-mw84 | In worker mode, http_get_last_response_headers() returned headers from a previous request |
| GHSA-h764-4wh7-m7j2 | In worker mode, ending the worker loop after a JSON POST freed the same pointer twice |
| GHSA-x6j6-qv7w-fq3c | In worker mode, a fatal error during request startup left the request waiting forever |
If you run Laravel Octane or another worker mode setup on v5.0.3, the first one affects you. FrankenPHP says the others need specific app code or non-default configuration. They don't affect common Laravel and Symfony setups.
It also upgrades Mercure to 1.1.5.
Only the frankenphp images include FrankenPHP.
How to update
| If you use | Example | Do this |
|---|---|---|
| A floating tag | 8.4-fpm-nginx |
Pull and redeploy |
| A release tag | 8.4-fpm-nginx-v5.0.3 |
Change it to 8.4-fpm-nginx-v5.0.4 |
| A patch version tag | 8.4.27-fpm-nginx |
Pull and redeploy |
Then confirm Brotli is patched. On Debian:
docker compose exec php dpkg-query -W libbrotli1On Alpine:
docker compose exec php sh -c "apk list -I | grep brotli-libs"On FrankenPHP, confirm the version too:
docker compose exec php frankenphp versionFrankenPHP 1.13.4 needs a newer Brotli than Debian Bookworm ships. The Bookworm FrankenPHP images bundle Brotli 1.2.1 in /usr/local/lib, and both FrankenPHP and curl use it.
What's Changed
- Security: Upgrade Brotli past CVE-2026-111497 in every variation by @jaydrogers
- Security: Update FrankenPHP to v1.13.4 by @jaydrogers
Full Changelog: v5.0.3...v5.0.4
