CVE-2026-128019 · Runtime
NO FIX YET · SEE WHAT TO DO
In FrankenPHP worker mode, per-request environment variables carry over into later requests handled on the same PHP thread. An attacker can read values set for another user's request through getenv() or $_SERVER, which can make an app act on another user's routing, tenant or authorization values.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications running FrankenPHP before 1.13.4 in worker mode that use env directives with request placeholders or WithRequestEnv(), and read those values through getenv() or $_SERVER for decisions. Deployments not using worker mode or these env settings are not exposed by this description.
Not affected if fixed-version, no-request-env, not-worker-mode
Who cares frankenphp, php, self-hosted, worker-mode
frankenphp version or the Docker image tag; affected versions are before 1.13.4.worker directives, and env directives with request placeholders or WithRequestEnv() calls in Go code.getenv() or $_SERVER for routing, tenant or authorization decisions.FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.13.4 or later.NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.