CVE-2026-122233 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.4 does not clear the last HTTP response headers between requests in worker mode, so a later request can read headers fetched by an earlier request on the same worker thread. An attacker can thereby see other users' Set-Cookie or token headers returned by backend APIs.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running FrankenPHP before 1.13.4 in worker mode, where PHP processes are reused across requests. The exposure needs application code that makes outbound HTTP calls and reads the last response headers, so apps that do not use that function or run without worker mode are less exposed. Operators who run FrankenPHP in default mode can skip it.
Not affected if default-config, no-http-get-last-response-headers
Who cares frankenphp, php, self-hosted, worker-mode
frankenphp version and compare it against 1.13.4.http_get_last_response_headers().1.13.4 or later.FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.