Repository navigation
Security: Patch Brotli for CVE-2026-111497 and upgrade FrankenPHP to 1.13.4 - #737
Merged
Merged
Conversation
The official PHP images still ship vulnerable libbrotli builds, which PHP's curl extension links against. List libbrotli1 (Debian) and brotli-libs (Alpine) in every variation so the build upgrades them to the patched distribution packages. Remove them once the official images ship the fix. The Alpine install helper now runs `apk add --upgrade`, so an already-installed package is upgraded the same way `apt-get install` does on Debian.
FrankenPHP 1.13.4 fixes seven vulnerabilities, including a crash in worker mode that 1.13.2 introduced. Its cbrotli dependency needs libbrotli 1.1 or newer, which Bookworm doesn't ship, so Bookworm images now build Brotli 1.2.1 from source and load it ahead of the distribution library.
Contributor
Images for PR #737
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:737-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR patches Brotli for CVE-2026-111497 in every variation and upgrades FrankenPHP to 1.13.4.
libbrotli1(Debian) andbrotli-libs(Alpine) at build timeBrotli CVE-2026-111497
CVE-2026-111497 (Node2Shell) is an out-of-bounds write in the Brotli decoder. PHP reaches it through curl when a response is Brotli encoded, for example with
CURLOPT_ENCODING.The official PHP images ship vulnerable versions:
1.0.9-2+b61.0.9-2+deb12u11.1.0-2+b71.1.0-2+deb13u11.2.0-r11.2.1-r0Each Dockerfile now lists the Brotli package so the build upgrades it. Remove them once the official images ship the fix. This is the same workaround FrankenPHP uses in its own images (#2767).
docker-php-serversideup-dep-install-alpinenow runsapk add --upgrade. Without it,apk addleaves an installed package at its current version, whileapt-get installon Debian upgrades it. Both helpers now behave the same way.FrankenPHP 1.13.4
putenv()from a shutdown function, destructor, or session handler left a dangling pointerSplTempFileObjectstream kept across requestshttp_get_last_response_headers()POSTThe Windows, macOS, and static binary fixes in that release don't apply to us.
Bookworm builds Brotli from source
1.13.4 moves cbrotli from 1.1.0 to 1.2.1, which needs libbrotli 1.1 or newer. Bookworm only has 1.0.9, so the FrankenPHP build would fail there. When
pkg-configfinds a libbrotli older than 1.1, the build stage compiles Brotli 1.2.1 from source (checksum verified), and the final image ships those libraries next tolibwatcher. Trixie and Alpine skip this step. This matches upstream (#2777)./etc/ld.so.conf.d/000-brotli.confputs/usr/local/libfirst. On arm64 the multiarch config sorts beforelibc.conf, and without this file the system 1.0.9 would still load. PHP's curl in the FrankenPHP Bookworm image uses 1.2.1 as well.Tested locally
All amd64, PHP 8.4.27.
/usr/local/lib, for FrankenPHP and curl1.2.1-r01.0.9-2+deb12u11.2.1-r0CI is the first build of fpm, fpm-apache, fpm-nginx, Trixie, Alpine 3.23, and arm64. The arm64 Bookworm loader order is only covered by CI's arm64 tests.
How to test
scripts/dev.sh --variation frankenphp --version 8.4 --os bookworm docker run --rm --entrypoint sh serversideup/php:8.4-frankenphp-bookworm -c \ 'frankenphp version; ldd /usr/local/bin/frankenphp /usr/lib/*/libcurl.so.4 | grep brotli' scripts/test-image.sh serversideup/php:8.4-frankenphp-bookworm 8.4.27Every Brotli library should resolve to
/usr/local/lib. Repeat with--os alpine3.24and--variation cli, and check the package version withapk list -I | grep brotliordpkg-query -W libbrotli1.