diff --git a/NEWS b/NEWS
index ee42cf7c4eb5f..523a0710f4fe9 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-12468 (Double-free of doc_comment when overriding static
     property via trait). (ilutov)
   . Fixed segfault caused by weak references to FFI objects. (sj-i)
+  . Fix memory leak if a circular reference is created inside a by-ref foreach
+    on the array variable. (danog)
 
 - DOM:
   . Fix registerNodeClass with abstract class crashing. (nielsdos)
diff --git a/Zend/tests/leak_foreach_on_ref.phpt b/Zend/tests/leak_foreach_on_ref.phpt
new file mode 100644
index 0000000000000..e09c3d4588685
--- /dev/null
+++ b/Zend/tests/leak_foreach_on_ref.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Fix memory leak if a circular reference is created inside a by-ref foreach on the array variable.
+--FILE--
+<?php
+
+$a = [0];
+
+foreach ($a as &$v) {
+    $a[0] = &$a;
+    unset($a);
+    gc_collect_cycles();
+}
+
+?>
+==DONE==
+--EXPECT--
+==DONE==
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 90704993bb253..728b78cefa6f4 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3125,7 +3125,7 @@ ZEND_VM_HOT_HANDLER(127, ZEND_FE_FREE, TMPVAR, ANY)
 		if (Z_FE_ITER_P(var) != (uint32_t)-1) {
 			zend_hash_iterator_del(Z_FE_ITER_P(var));
 		}
-		zval_ptr_dtor_nogc(var);
+		zval_ptr_dtor(var);
 		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}
 
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 530fd7d3e117c..2d4728d51832a 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14317,7 +14317,7 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_FREE_SPEC_TMPVA
 		if (Z_FE_ITER_P(var) != (uint32_t)-1) {
 			zend_hash_iterator_del(Z_FE_ITER_P(var));
 		}
-		zval_ptr_dtor_nogc(var);
+		zval_ptr_dtor(var);
 		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}