diff --git a/configure.ac b/configure.ac
index ed5bd5de..caaff7e5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -70,7 +70,7 @@ dnl Checks for header files.
 AC_HEADER_ASSERT
 AC_HEADER_DIRENT
 AC_HEADER_SYS_WAIT
-AC_CHECK_HEADERS([stdint.h inttypes.h unistd.h math.h execinfo.h strings.h getopt.h syslog.h grp.h pwd.h io.h])
+AC_CHECK_HEADERS([stdint.h inttypes.h unistd.h math.h execinfo.h strings.h getopt.h syslog.h grp.h pwd.h io.h alloca.h])
 AC_CHECK_HEADERS([sys/file.h sys/sysctl.h sys/ioctl.h sys/time.h sys/types.h sys/mkdev.h sys/sysmacros.h sys/stat.h sys/prctl.h sys/sysinfo.h sys/utsname.h])
 AC_CHECK_HEADERS([linux/fs.h linux/btrfs.h linux/fiemap.h mach/mach_time.h])
 
diff --git a/os/portable.h b/os/portable.h
index a426dfd0..f8074306 100644
--- a/os/portable.h
+++ b/os/portable.h
@@ -159,6 +159,10 @@
 #include <unistd.h>
 #endif
 
+#if HAVE_ALLOCA_H
+#include <alloca.h>
+#endif
+
 #if TIME_WITH_SYS_TIME
 #include <sys/time.h>
 #include <time.h>
diff --git a/os/unix.c b/os/unix.c
index af372b2a..b71a2e5b 100644
--- a/os/unix.c
+++ b/os/unix.c
@@ -863,9 +863,9 @@ int os_script(char** argv, char** envp, const char* run_as_user)
 				++envv_count;
 			}
 			int scrubbed_count = sizeof(envp_scrubbed) / sizeof(envp_scrubbed[0]) - 1;
-			char** envp_dynamic = malloc((size_t)(scrubbed_count + envv_count + 1) * sizeof(char*));
-			if (!envp_dynamic)
-				_exit(126);
+
+			/* use alloca instead of malloc after fork for async-signal safety in multithreaded process */
+			char** envp_dynamic = alloca((size_t)(scrubbed_count + envv_count + 1) * sizeof(char*));
 			for (int i = 0; i < scrubbed_count; ++i) {
 				envp_dynamic[i] = envp_scrubbed[i];
 			}