Security Digest · Critical advisory (no CVE assigned)
GHSA-x9p2-77v6-6vhf: FrankenPHP has delayed propagation of security fixes in upstream base images
Delayed propagation of security fixes in upstream base images Summary Vulnerability in base Docker images (PHP, Go, and Alpine) not automatically propagating to FrankenPHP images.
CVSS 9.8 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/dunglas/frankenphp | < 1.1.11 | 1.1.11 |
Details
Delayed propagation of security fixes in upstream base images
Summary
Vulnerability in base Docker images (PHP, Go, and Alpine) not automatically propagating to FrankenPHP images.
FrankenPHP's container images were previously built only when specific version tags were updated or when manual triggers were initiated. This meant that if an upstream base image (such as Alpine Linux or official PHP/Go images) received a security patch under an existing tag, the FrankenPHP image would remain on the older, vulnerable version of those base layers.
Impact
Users pulling FrankenPHP images may have been running environments with known vulnerabilities in underlying system libraries (e.g., libcrypto3) even if they were using the "latest" version of a specific FrankenPHP tag.
Specifically, this includes vulnerabilities recently patched in Alpine 3.20.9, 3.21.6, 3.22.3, and 3.23.3, such as CVE-2025-15467 (Remote Code Execution in libcrypto3).
Details
CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-x9p2-77v6-6vhf github.com
- github.com github.com