github.com/dunglas/frankenphp
Go4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/dunglas/frankenphppage 1 of 1
- CVE-2026-24894HIGHCVSS 7.5EG 7.5fixed in 1.11.22026-02-12
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to…
- CVE-2026-24895CRITICALCVSS 9.8EG 9.8fixed in 1.11.22026-02-12
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased…
- CVE-2026-45062HIGHCVSS 8.1EG 8.1fixed in 1.12.32026-05-15
FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two…
- CVE-2026-82416HIGHCVSS 7.7EG 7.7fixed in 1.12.52026-10-13
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at…
Check whether github.com/dunglas/frankenphp is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/dunglas/frankenphp CVEs against the assets you own.
Book a Demo →