CVE-2026-122233: FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling httpgetlastresponseheaders() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only FrankenPHP deployments using worker mode are described as affected. The leak occurs when requests are handled on the same worker thread and a later request calls http_get_last_response_headers().
What must happen for an attacker to obtain leaked data?
A prior request on the same worker thread must have fetched an HTTP response containing sensitive headers, such as Set-Cookie or token headers. A later request must be able to invoke http_get_last_response_headers() to read those retained headers.
Are non-worker requests affected?
The described condition is specific to worker mode because its requests skip RSHUTDOWN, where the response-header state would otherwise be reset.
What version resolves the issue?
Upgrade FrankenPHP to version 1.13.4 or later. Versions before 1.13.4 are identified as affected.