Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-122233FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

Low 3.7

In plain English

A low-severity security flaw in frankenphp from php. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.

Affected products (as reported)

Vendor	Product	Versions
php	frankenphp	0 – before 1.13.4

Weakness: CWE-488 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-pmvg-8483-mw84) vendor-advisory
https://github.com/php/frankenphp/commit/3fade63bb1c1d246926ed8a00520015f94cdc819 patch
frankenphp v1.13.4 Release Notes release-notes
VulnCheck Advisory: FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode third-party-advisory