EUVD-2026-125088

FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write CVE-2026-111497. Unauthenticated remote attackers can send crafted data to applications that pass it to brotliuncompressadd ...