CVE-2026-128019
MEDIUM
NVD
CVSS Score
4.8
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.