CVE-2026-128019 json
FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
published 19d ago modified 2d ago also EUVD-2026-125083 , GHSA-8386-64gm-3m8q
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository php/frankenphp. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
Patch / fix
Is CVE-2026-128019 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected products
- php frankenphp
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199
patch
-
github.com
/php/frankenphp/security/advisories/GHSA-8386-64gm-3m8q
vendor-advisory, advisory
-
vulncheck.com
/advisories/frankenphp-before-1.13.4-information-disclosure-via-per-request-environment-variable-leak
third-party-advisory
Sources
- CVE List CVE-2026-128019
- NVD CVE-2026-128019
- Maintainer advisory GHSA-8386-64gm-3m8q
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of php/frankenphp published their own advisory on GitHub. Reviewed sources take precedence over it.