NES for PHP 8 Release Notes: PHP 8.1

PHP 8.1

8.1.1 (NES) - November 3, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v8.1.34-nes-8.1.1/ (see Installation)

Based on PHP 8.1.34.

This release patches the following CVEs:

• CVE-2026-6722 The SOAP apache:Map decoder stored values in its reference map (SOAP_GLOBAL(ref_map)) without holding a reference to them, so a later lookup in the same message used a value freed in between (use-after-free). - (Critical)
• CVE-2026-7261 SoapServer::handle() freed the session-persisted server object when a SOAP header raised a fault or an exception with SOAP_PERSISTENCE_SESSION on, while the session still held it, and a later request used the freed object (use-after-free). - (Medium)
• CVE-2026-7262 The SOAP apache:Map decoder checked the wrong node for NULL, so a map item with a missing <value> element dereferenced a NULL pointer and crashed the process. - (Low)
• CVE-2026-6735 The full PHP-FPM status page (?full&html, ?full&xml) printed each worker's request URI unescaped in its HTML and XML output, and escaped the query string without quote flags, so a crafted request gave cross-site scripting against whoever opens the status page. - (High)
• CVE-2026-7259 mb_regex_encoding() accepted an encoding that Oniguruma knows and mbstring's own encoding layer (mbfl) does not, such as ISO-8859-11, and left the regex state's mbfl encoding NULL; every later mbregex call (mb_ereg(), mb_eregi(), mb_ereg_replace(), mb_split(), mb_ereg_match(), mb_ereg_search_init(), …) passed that NULL to php_mb_check_encoding(), which dereferenced it: a crash (denial of service). - (Low)
• CVE-2026-7568 metaphone() indexed its input with a signed int offset while the string length is a size_t, so a very long string overflowed the signed integer and read out of bounds. - (Medium)
• CVE-2025-14179 PDO:quote on a pdo_firebird connection stopped doubling quotes at the first NUL byte, so the rest of the string was copied into the SQL text unescaped: SQL injection. - (High)
• CVE-2026-7258 Many functions (urldecode() among them) passed a signed char to the ctype.h functions; for bytes >= 0x80 the argument was negative, and C libraries whose tables do not cover negative values read out of bounds. - (Medium)
• CVE-2026-14355 openssl_encrypt() sized its output buffer for a block cipher, too small for the AES key wrap with padding modes (AES-*-WRAP-PAD), so a call wrote past the end of the heap block. - (Medium)
• CVE-2026-9672 The GIF LZW decoder of the bundled libgd (LWZReadByte_(), ReadImage()) read uninitialised stack memory and went out of bounds on a crafted GIF with a repeated clear code.
• CVE-2026-17543 pg_convert(), and through it pg_insert(), pg_update(), pg_select() and pg_delete(), quoted escaped strings as E'...'; with standard_conforming_strings on (PostgreSQL's default) PQescapeStringConn() leaves backslashes alone, so a value such as x\' OR 1=1 -- closed the literal (SQL injection through values a script believes are escaped). - (High)
• CVE-2026-7260 phar_get_link_source() followed the symbolic links of a tar archive recursively without a bound, so a phar with circular symlinks overflowed the stack and crashed the process. - (Medium)
• CVE-2026-92842 The convert.base64-encode and convert.quoted-printable-* filters copied a line-break-chars option with pestrdup(), which stops at a NUL, but kept its full length, so the filter read past its copy and put heap bytes into its output (information disclosure). - (Medium)
• CVE-2026-91768 The FastCGI client check compared IPv6 addresses on 12 of 16 bytes, so an allowed address matched a whole /96 prefix and other hosts in it could talk FastCGI to the pool (run scripts with arbitrary parameters). - (Medium)
• CVE-2026-91769 Peer verification fell back to the certificate's Common Name whenever no subjectAltName matched, so a certificate whose SAN names another host but whose CN holds the expected name was accepted (RFC 6125 forbids the fallback once a DNS, SRV or URI identity is present). - (Medium)
• CVE-2026-91767 php_openssl_matches_wildcard_name() checked only the suffix's length, so a certificate wildcard name whose literal parts together were longer than the peer name made the length passed to memchr() wrap and read far past the name (heap out-of-bounds read). - (Medium)
• CVE-2025-1218 mysqlnd read several fields of server packets (OK, EOF, error, result set field, row, prepare response) without checking that the packet holds them, so a hostile or compromised MySQL server, or a man in the middle on an unencrypted connection, could make PHP read past the packet buffer and leak heap memory or crash. - (Low)
• CVE-2026-91766 The HTTP stream wrapper kept the Authorization, Cookie and Proxy-Authorization headers a script sets in the http context's header option when it followed a redirect to another origin, handing them to a server the script never meant to trust. - (Medium)
• CVE-2026-91765 The SOAP XML parsing and decoding code (cleanup_xml_node(), master_to_zval_int()) recursed with the nesting depth of the document, or of its href references, so a deeply nested message overflowed the stack and crashed the process. - (High)
• CVE-2025-14181 get_http_body() of SoapClient kept the body size of a chunked HTTP response in an int and checked the sum of two chunk sizes for overflow with signed arithmetic, which the compiler may remove: a malicious SOAP server could make the client reallocate a buffer too small for the data it then read into it (heap buffer overflow). - (Medium)
• CVE-2026-6103 phar_parse_tarfile() read a tar entry's octal size into 32 bits without checking it, and skipped the data blocks of regular files only, so an oversized size or the data of another entry type was then parsed as further tar headers: a crafted archive could make PHP see entries that other tools do not (archive entry injection, e.g. past a scanner). - (Medium)
• GHSA-ch8v-r6jh-4vvr php_filter_encode_url() initialised 255 of the 256 entries of its "must encode" table, so whether byte 0xFF was percent-encoded by FILTER_SANITIZE_ENCODED depended on stack contents. - (Low)
• CVE-2026-93682 The HTTP stream wrapper read one byte past the end of a redirect's empty Location header value: an empty Location is stored as a 1-byte heap copy, and the redirect code tested location[1], a heap over-read; a non-NUL stray byte there could send the redirect to the resource's directory instead of "/". - (Medium)
• CVE-2022-1586 The bundled PCRE2 10.39 of PHP 8.1.34 misses later fixes: CVE-2022-1586 (out-of-bounds read in the JIT's compile_xclass_matchingpath for Unicode property classes, fixed in 10.40), CVE-2022-1587 (out-of-bounds read in the JIT's get_recurse_data_length for recursions, 10.40), CVE-2026-89156 (pcre2_match runs the JIT without validating the whole UTF subject, 10.48), CVE-2026-103111 (an out-of-bounds write from a large single JIT stack frame, 10.49) and GHSA-43gg-c3xx-7w7g (the AArch64 NEON character search of the JIT reads past the end of the subject, 10.47).
• CVE-2021-38115 The bundled libgd's TGA reader ignored a short read of the image identification field, leaving the buffer uninitialised (CVE-2021-38115), and its BMP and WebP writers ignored gdPutBuf results, the BMP writer's error path freeing the caller's context (CVE-2021-40812).
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default) leaks through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)