CVE-2026-122233 FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122233?
CVE-2026-122233 is a medium-severity vulnerability in frankenphp, published on 4 Nov 2026.
Official description
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Weakness: CWE-488
Which versions are affected by CVE-2026-122233?
How do I fix CVE-2026-122233?
No fix has been published for CVE-2026-122233 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122233 being exploited?
There is no known exploitation of CVE-2026-122233 in the wild and no public exploit code.
Sources
Also known as GHSA-2xgr-grwj-fv6m, GHSA-pmvg-8483-mw84.