CVE-2026-128019: FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $SERVER, causing applications to act on another user's routing, tenant, or authorization values.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use FrankenPHP worker mode on versions before 1.13.4 and set per-request environment variables. The exposed mechanisms are env directives with request placeholders and WithRequestEnv().
What must an attacker do to exploit the issue?
An attacker must cause a request to be handled on a PHP thread that previously processed another request with per-request environment values. The application must expose or act on values available through getenv() or $_SERVER.
What is the impact of leaked values?
Later requests may receive routing, tenant, or authorization values from another user's request. This can disclose those values and cause the application to make decisions using the wrong request context.
How can teams determine whether they are at risk?
Check whether FrankenPHP is running before version 1.13.4 in worker mode. Review configuration and application code for env directives using request placeholders or calls to WithRequestEnv(), then identify uses of getenv() or $_SERVER that consume those values.