php/frankenphp Security Advisories | GitStock

high2026-10-15

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

GHSA-v3ph-cgqh-r8p5 · CVE-2026-82416

high2026-05-15

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

GHSA-3g8v-8r37-cgjm · CVE-2026-45062

high2026-02-12

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

GHSA-g966-83w7-6w38 · CVE-2026-24895

high2026-02-12

FrankenPHP leaks session data between requests in worker mode

GHSA-r3xh-3r3w-47gp · CVE-2026-24894

critical2026-02-05

FrankenPHP has delayed propagation of security fixes in upstream base images

GHSA-x9p2-77v6-6vhf