Skip to content

v4.5.3

Choose a tag to compare

View all tags
@jaydrogers jaydrogers released this 21 Oct 20:56
· 76 commits to main since this release
Immutable release. Only release title and notes can be modified.
v4.5.3
e44c757

馃毃 Critical PHP and NGINX security update for v4 users

Important

This release is only for people who can't move to v5 yet. It rebuilds v4.5.1 on PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and updates NGINX to 1.30.6. If you're already on v5, use v5.0.2 instead. See #721 for the full story.

Warning

v4.5.3 is published to release tags only (like 8.4-fpm-nginx-v4.5.3). Floating tags like 8.4-fpm-nginx and latest stay on v5, so you need to update your pin to get this fix.

v4.5.2 was tagged but never published. Go straight from v4.5.1 to v4.5.3.

Note

The CVEs below are in php/php-src and nginx/nginx upstream, not in this repo. This release rebuilds the v4 images on the patched official Docker PHP images and bumps the NGINX we install.

Upstream CVEs (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35)

CVE Severity Issue PHP advisory
CVE-2026-109618 Critical (9.2) Remote code execution through out-of-memory corruption GHSA-w8hw-w9fx-j79w
CVE-2026-109619 Critical (9.2) Remote code execution through stale global state GHSA-6wmf-4rv5-p3rp

Both can be exploited without logging in. See php.net's advisory for who is at risk.

PHP Version in this release
8.5 8.5.12
8.4 8.4.27
8.3 8.3.36
8.2 8.2.35
8.1 and older Not included (no official fix)

php.net didn't release a fix for 8.1 or older, so this release doesn't rebuild them. If you're on 8.1 or older, move to 8.2 or newer.

Upstream CVEs (NGINX 1.30.6)

These were fixed for v5 in v5.0.1. This brings the same fixes to v4.

CVE nginx Issue F5 advisory
CVE-2026-15176 Med Buffer overflow when using alias with rewrite K000162416
CVE-2026-93479 Med Buffer overflow in script evaluation (string expressions with variables) K000162607
CVE-2026-95101 Med Request body injection in HTTP/3 K000162613
CVE-2026-97629 Med Session forgery with TLS session ticket key rotation K000162606
CVE-2026-97205 Med Use-after-free in ngx_http_ssi_module with AIO K000162608

Only the fpm-nginx images include NGINX.

馃悩 FrankenPHP build pinned

FrankenPHP stays on 1.12.6. Its build used to pull the latest Caddy and Caddy modules, which no longer build with FrankenPHP 1.12.6. Caddy is now pinned to 2.11.4, with Mercure, Vulcain, and Brotli on the versions FrankenPHP 1.12.6 ships with. This also keeps out the Caddy 2.11.6 HTTP/2 crash from #712.

How to update

Change v4.5.1 (or whichever v4 release you pin) to v4.5.3:

Before After
8.4-fpm-nginx-v4.5.1 8.4-fpm-nginx-v4.5.3
8.4-fpm-nginx-alpine-v4.5.1 8.4-fpm-nginx-alpine-v4.5.3
8.3-cli-bookworm-v4.5.1 8.3-cli-bookworm-v4.5.3

Then confirm you're on the patched version:

docker compose exec php php -v

Plan your move to v5

v4 will not get regular updates. This was a one-off because of how severe these CVEs are. The upgrade guide walks through the v5 changes.

Full Changelog: v4.5.1...v4.5.3

Assets 3
Loading