Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-128019— FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak

Quick assessment

Affected
php frankenphp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FrankenPHP 在 1.13.4 之前版本中存在一个信息泄露漏洞，该漏洞发生在 worker（工作进程）模式下，导致每个请求的环境变量会泄漏到同一 PHP 线程上的后续请求中。攻击者可以通过 或 读取通过带有请求占位符的 指令或 设置的值，从而可能导致应用程序基于其他用户的路由、租户或授权值执行操作。

CVSS 4.8 · Medium EPSS 0.25% · P16

Affected Version Matrix 2

VendorProduct Version RangeStatus
php frankenphp < 1.13.4 affected
1.13.4 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-128019

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
Source: CVE Program / CVE List V5
Vulnerability Description
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
php frankenphp 0 ~ 1.13.4 -

II. Public POCs for CVE-2026-128019

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-128019

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-128019 (1)

Vendor Advisories for CVE-2026-128019 (1)

Other References for CVE-2026-128019 (1)

Same Patch Batch · php · 2026-11-13 · 14 CVEs total

CVE-2026-128027 9.8 CRITICAL FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes
CVE-2026-128014 8.1 HIGH FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder
CVE-2026-128023 7.4 HIGH FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing
CVE-2026-128016 6.5 MEDIUM FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode
CVE-2026-128015 6.5 MEDIUM FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown
CVE-2026-128025 6.5 MEDIUM FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos
CVE-2026-128026 6.4 MEDIUM FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv
CVE-2026-128024 5.9 MEDIUM FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion
CVE-2026-128020 5.9 MEDIUM FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion
CVE-2026-128022 5.3 MEDIUM FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests
CVE-2026-128018 3.7 LOW FrankenPHP before 1.13.4 Pending Worker Request Denial of Service
CVE-2026-128021 3.7 LOW FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode
CVE-2026-128017 3.7 LOW FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST

IV. Related Vulnerabilities

Same product: frankenphp
Same vendor: php
Same weakness: CWE-200