diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index d97dc0825937..f4a9e74a9c85 100644
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -1107,6 +1107,10 @@ PHP_FUNCTION(strtotime)
 		RETURN_FALSE;
 	}
 
+	if (memchr(ZSTR_VAL(times), '\0', ZSTR_LEN(times)) != NULL) {
+		RETURN_FALSE;
+	}
+
 	tzi = get_timezone_info();
 	if (!tzi) {
 		return;
diff --git a/ext/date/tests/strtotime_nul_byte.phpt b/ext/date/tests/strtotime_nul_byte.phpt
new file mode 100644
index 000000000000..615450b3df61
--- /dev/null
+++ b/ext/date/tests/strtotime_nul_byte.phpt
@@ -0,0 +1,17 @@
+--TEST--
+strtotime() rejects strings containing NUL bytes
+--CREDITS--
+HackingRepo (relunsec@insitetech.jp)
+--FILE--
+<?php
+
+var_dump(strtotime("\0"));
+var_dump(strtotime("2026-11-02\0"));
+var_dump(strtotime("2026-11-02\0 tomorrow"));
+var_dump(strtotime("tomorrow\0"));
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)