Information Disclosure in FrankenPHP Affects Multiple Versions
CVE-2026-128019

6.3MEDIUM

Key Information:

Vendor

PHP
Status
FrankenPHP
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128019?

FrankenPHP prior to version 1.13.4 is susceptible to an information disclosure flaw in worker mode. This vulnerability allows for the leakage of per-request environment variables into subsequent requests processed within the same PHP thread. Attackers could exploit this to read sensitive environmental values configured via env directives or utilized through request placeholders, enabling unauthorized access to another user's routing, tenant, or authorization details, thereby compromising the integrity of application interactions.

Affected Version(s)

frankenphp 0 < 1.13.4

frankenphp 1.13.4

References

https://github.com/php/frankenphp/security/advisories/GHS...
vendor-advisory
https://github.com/php/frankenphp/commit/72f9366de07093ba...
patch
https://www.vulncheck.com/advisories/frankenphp-before-1....
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

inanna-malick
.