Information Disclosure in FrankenPHP by PHP Inc.

CVE-2026-122233

What is CVE-2026-122233?

FrankenPHP prior to version 1.13.4 is susceptible to an information disclosure vulnerability due to improper handling of HTTP response headers in worker mode. The application fails to clear last HTTP stream response headers between requests, leading to a scenario where earlier requests’ Set-Cookie or token headers can be retrieved by subsequent requests on the same worker thread. This flaw may allow unauthorized access to sensitive information, which can compromise user privacy and security. Users are advised to upgrade to version 1.13.4 or later to mitigate this risk.

References