{"id":"CVE-2026-128019","summary":"FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak","details":"FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.","aliases":["GHSA-8386-64gm-3m8q"],"modified":"2026-11-14T07:04:32.025838235Z","published":"2026-11-13T09:34:08.571Z","database_specific":{"cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128019.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128019.json"},{"type":"FIX","url":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199"},{"type":"ADVISORY","url":"https://github.com/php/frankenphp/security/advisories/GHSA-8386-64gm-3m8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128019"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-information-disclosure-via-per-request-environment-variable-leak"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/frankenphp","events":[{"introduced":"0"},{"fixed":"7f50be9d86261bf7cff9b051ab4fb572e95020ed"},{"fixed":"72f9366de07093ba3f524af3e6c73451012e5199"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"1.13.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"72f9366de07093ba3f524af3e6c73451012e5199"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.13.3","caddy/v1.13.3","v1.13.2","caddy/v1.13.2","v1.13.0","caddy/v1.13.0","v1.13.1","caddy/v1.13.1","v1.12.7","caddy/v1.12.7","v1.12.6","caddy/v1.12.6","v1.12.5","caddy/v1.12.5","v1.12.4","caddy/v1.12.4","v1.12.3","caddy/v1.12.3","v1.12.2","caddy/v1.12.2","v1.12.1","caddy/v1.12.1","v1.12.0","caddy/v1.12.0","v1.11.3","caddy/v1.11.3","v1.11.2","caddy/v1.11.2","v1.11.1","caddy/v1.11.1","v1.11.0","caddy/v1.11.0","v1.10.1","caddy/v1.10.1","v1.10.0","caddy/v1.10.0","v1.9.1","caddy/v1.9.1","v1.9.0","caddy/v1.9.0","v1.8.0","caddy/v1.8.0","v1.7.0","caddy/v1.7.0","v1.6.2","caddy/v1.6.2","v1.6.1","caddy/v1.6.1","v1.6.0","caddy/v1.6.0","v1.5.0","caddy/v1.5.0","v1.4.4","caddy/v1.4.4","v1.4.3","caddy/v1.4.3","v1.4.2","caddy/v1.4.2","v1.4.1","caddy/v1.4.1","v1.4.0","caddy/v1.4.0","v1.3.6","caddy/v1.3.6","v1.3.5","caddy/v1.3.5","v1.3.4","caddy/v1.3.4","v1.3.3","caddy/v1.3.3","v1.3.2","caddy/v1.3.2","v1.3.1","caddy/v1.3.1","v1.3.0","caddy/v1.3.0","v1.2.5","caddy/v1.2.5","v1.2.4","caddy/v1.2.4","v1.2.3","caddy/v1.2.3","v1.2.2","caddy/v1.2.2","v1.2.1","caddy/v1.2.1","v1.2.0","caddy/v1.2.0","v1.1.5","caddy/v1.1.5","v1.1.4","caddy/v1.1.4","v1.1.3","caddy/v1.1.3","v1.1.2","caddy/v1.1.2","v1.1.1","caddy/v1.1.1","v1.1.0","caddy/v1.1.0","v1.0.3","caddy/v1.0.3","v1.0.2","caddy/v1.0.2","v1.0.1","caddy/v1.0.1","v1.0.0","caddy/v1.0.0","v1.0.0-rc.4","caddy/v1.0.0-rc.4","v1.0.0-rc.3","caddy/v1.0.0-rc.3","v1.0.0-rc.2","caddy/v1.0.0-rc.2","v1.0.0-beta.2","caddy/v1.0.0-beta.2","v1.0.0-beta.1","caddy/v1.0.0-beta.1"],"database_specific":{"vanir_signatures":[{"digest":{"line_hashes":["304308594583339098576839732954639420072","66802472842974957615797075536803413303","302890241589258581044531052643943867088","304026885285897927489943236679658743541","304809327329972578406384144092462149148","29650896154380502590383525367669703053","218449971434330715713398621655738504458","147410589115975636509039549120848853961","163877279756617946280793538730784991282","242818528824635313455204880134738973185","337835259259062946927811583531741587401","139627647117939235337564864645843434157","249502245796395734274932435495249227562","268511756209266685862903630289483099723","23370247622921294742353240010492444502","284121300777469162487870647839832169822","255783051618605843612634270711823522415","98398459558667979974142741120475401168","278870243489547169741952100571993425700","272650860715316273296326076532958445055","12585657943474990347619935420373933479","209836072264157129996670252314922278488","138877627639073113808325389276016521779","177188824490996335856430262414564259633","69503538764086195014388852707355751851","279874371023466441056393952048699479074","232281842026571029580086981005274892670","80334818781086666288309268875952862142","34783429094674550503744472528328615117","42424720599984913838683627835003200551","301916198858400421281196276841487658203","201377391380580626249889722479967630701","50255804152344982457769681033736448786","254427245608711937543790400823150423315","33387308728925622775742702280396547216","75526306141653486142359827213920486103","287243023042985364568116220617160989675","217855750046246757951047426790299686072","90630752662337100292435971138795512329","261360424054729177321554229165635583612","79494676942292175328689643169380658533","241515625967124647915000197005433861736","188956656392941260855325442680840702698","23427805532051036110227552581936181092","118289070517581108731248269025931097104","95612309503986796028835730545450435030","127090641090963343378568497354464615705","132822636433209617789142645879041807494","268219654547673565074286617020735262119","49620542087130831827738293481921466599","334699274481132341015447794941698806988","227946161781317760940750645339131402502","180952204219166984518728604619568514443","187132795200899466281477967343526794902","242369625874764053456360155473920566726","220821898859781282111716070010618008707","251802100586541038034138493345063249729","206984344510298477109934840331373982948","178875099156746895488133732319784867005","330262440863589751869049876091998346679","238329930311123975456439769996418432576","246599668567677620364408727375915604537","139559931381640587652356206282792063612","138579144023446959947969062291389551067","55934673431409329499649700728963886501","96097763901391590463459241697689786610","261232351417802941098025188919101998925","225270640421991475024335729423979823876","337171319350645521134229371548994057999","27683884360191112757439647161657373428","304277588485205937585578616553339085031"],"threshold":0.9},"id":"CVE-2026-128019-0c9588f8","signature_type":"Line","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c"},"deprecated":false},{"source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"frankenphp_dup_env"},"deprecated":false,"digest":{"function_hash":"65118505193037535945095438604741048472","length":262},"id":"CVE-2026-128019-2b604c00","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"frankenphp_shutdown_dummy_request"},"deprecated":false,"digest":{"length":119,"function_hash":"201483379083728667205256956302007430325"},"id":"CVE-2026-128019-32541a8f","signature_type":"Function"},{"target":{"file":"frankenphp.c","function":"PHP_FUNCTION"},"deprecated":false,"digest":{"function_hash":"110584076155258754007147506844086504521","length":822},"id":"CVE-2026-128019-6a821f9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199"},{"deprecated":false,"digest":{"function_hash":"231153875923491617791263442526650007236","length":203},"id":"CVE-2026-128019-837a4526","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"reset_sandboxed_environment"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"get_full_env"},"deprecated":false,"digest":{"function_hash":"8201018770133958710253969815126229191","length":355},"id":"CVE-2026-128019-a75cb793"},{"id":"CVE-2026-128019-b84b3c41","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"frankenphp_merge_with_prepared_env"},"deprecated":false,"digest":{"function_hash":"231078220491626190999931205135930191875","length":162}},{"target":{"file":"frankenphp.c","function":"frankenphp_lookup_env"},"deprecated":false,"digest":{"length":349,"function_hash":"94605501273072098551848618191881177492"},"id":"CVE-2026-128019-c677a6ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199"},{"id":"CVE-2026-128019-f041c044","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","target":{"file":"frankenphp.c","function":"frankenphp_worker_request_shutdown"},"deprecated":false,"digest":{"function_hash":"33402526722042561403015784242260791508","length":870}}],"vanir_signatures_modified":"2026-11-14T07:04:32Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128019.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}