Live › vulnerability › CVE-2026-82416
Go to dashboardFrankenPHP worker mode can keep a PHP session ID from one request and reuse it in a later request on the same worker, when the session extension is built as a shared module. An attacker can then read another user's session or hijack it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/dunglas/frankenphp | go | < 1.12.5 | 1.12.5 |
php -m or by checking how the binary was built; official static binaries and Docker images are not affected1.12.51.12.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-82416")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.