Low
6.3
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
CVE-2026-122233
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| phpfrankenphp |
< 1.13.4→ 1.13.4 |
1.13.4 |
Original description The description as published by the source.
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com