Information Disclosure in FrankenPHP Affects Multiple Clients
CVE-2026-128021

6.3MEDIUM

Key Information:

Vendor

PHP
Status
FrankenPHP
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128021?

FrankenPHP versions prior to 1.13.2 exhibit an information disclosure vulnerability that exposes libxml errors from earlier requests to later clients. This occurs because the worker mode does not reset the LIBXML(error_list) between requests. Attackers leveraging requests to the same worker thread can utilize functions like libxml_get_errors() and libxml_get_last_error() to access parsed document fragments and server filesystem paths associated with other clients.

Affected Version(s)

frankenphp 0 < 1.13.2

frankenphp 1.13.2

References

https://github.com/php/frankenphp/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/frankenphp-before-1....
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
alexandre-daubois
.