CVE-2026-128019

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128019
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128019.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128019
Aliases
  • GHSA-8386-64gm-3m8q
Published
2026-11-13T09:34:08Z
Modified
2026-11-14T07:04:32Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
Details

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128019.json"
}
References

Affected packages

Git / github.com/php/frankenphp

Affected ranges

Type
GIT
Repo
https://github.com/php/frankenphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f50be9d86261bf7cff9b051ab4fb572e95020ed
Fixed
72f9366de07093ba3f524af3e6c73451012e5199
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.13.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "72f9366de07093ba3f524af3e6c73451012e5199"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

caddy/v1.*
caddy/v1.0.0
caddy/v1.0.0-beta.1
caddy/v1.0.0-beta.2
caddy/v1.0.0-rc.2
caddy/v1.0.0-rc.3
caddy/v1.0.0-rc.4
caddy/v1.0.1
caddy/v1.0.2
caddy/v1.0.3
caddy/v1.1.0
caddy/v1.1.1
caddy/v1.1.2
caddy/v1.1.3
caddy/v1.1.4
caddy/v1.1.5
caddy/v1.10.0
caddy/v1.10.1
caddy/v1.11.0
caddy/v1.11.1
caddy/v1.11.2
caddy/v1.11.3
caddy/v1.12.0
caddy/v1.12.1
caddy/v1.12.2
caddy/v1.12.3
caddy/v1.12.4
caddy/v1.12.5
caddy/v1.12.6
caddy/v1.12.7
caddy/v1.13.0
caddy/v1.13.1
caddy/v1.13.2
caddy/v1.13.3
caddy/v1.2.0
caddy/v1.2.1
caddy/v1.2.2
caddy/v1.2.3
caddy/v1.2.4
caddy/v1.2.5
caddy/v1.3.0
caddy/v1.3.1
caddy/v1.3.2
caddy/v1.3.3
caddy/v1.3.4
caddy/v1.3.5
caddy/v1.3.6
caddy/v1.4.0
caddy/v1.4.1
caddy/v1.4.2
caddy/v1.4.3
caddy/v1.4.4
caddy/v1.5.0
caddy/v1.6.0
caddy/v1.6.1
caddy/v1.6.2
caddy/v1.7.0
caddy/v1.8.0
caddy/v1.9.0
caddy/v1.9.1
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128019.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "304308594583339098576839732954639420072",
                "66802472842974957615797075536803413303",
                "302890241589258581044531052643943867088",
                "304026885285897927489943236679658743541",
                "304809327329972578406384144092462149148",
                "29650896154380502590383525367669703053",
                "218449971434330715713398621655738504458",
                "147410589115975636509039549120848853961",
                "163877279756617946280793538730784991282",
                "242818528824635313455204880134738973185",
                "337835259259062946927811583531741587401",
                "139627647117939235337564864645843434157",
                "249502245796395734274932435495249227562",
                "268511756209266685862903630289483099723",
                "23370247622921294742353240010492444502",
                "284121300777469162487870647839832169822",
                "255783051618605843612634270711823522415",
                "98398459558667979974142741120475401168",
                "278870243489547169741952100571993425700",
                "272650860715316273296326076532958445055",
                "12585657943474990347619935420373933479",
                "209836072264157129996670252314922278488",
                "138877627639073113808325389276016521779",
                "177188824490996335856430262414564259633",
                "69503538764086195014388852707355751851",
                "279874371023466441056393952048699479074",
                "232281842026571029580086981005274892670",
                "80334818781086666288309268875952862142",
                "34783429094674550503744472528328615117",
                "42424720599984913838683627835003200551",
                "301916198858400421281196276841487658203",
                "201377391380580626249889722479967630701",
                "50255804152344982457769681033736448786",
                "254427245608711937543790400823150423315",
                "33387308728925622775742702280396547216",
                "75526306141653486142359827213920486103",
                "287243023042985364568116220617160989675",
                "217855750046246757951047426790299686072",
                "90630752662337100292435971138795512329",
                "261360424054729177321554229165635583612",
                "79494676942292175328689643169380658533",
                "241515625967124647915000197005433861736",
                "188956656392941260855325442680840702698",
                "23427805532051036110227552581936181092",
                "118289070517581108731248269025931097104",
                "95612309503986796028835730545450435030",
                "127090641090963343378568497354464615705",
                "132822636433209617789142645879041807494",
                "268219654547673565074286617020735262119",
                "49620542087130831827738293481921466599",
                "334699274481132341015447794941698806988",
                "227946161781317760940750645339131402502",
                "180952204219166984518728604619568514443",
                "187132795200899466281477967343526794902",
                "242369625874764053456360155473920566726",
                "220821898859781282111716070010618008707",
                "251802100586541038034138493345063249729",
                "206984344510298477109934840331373982948",
                "178875099156746895488133732319784867005",
                "330262440863589751869049876091998346679",
                "238329930311123975456439769996418432576",
                "246599668567677620364408727375915604537",
                "139559931381640587652356206282792063612",
                "138579144023446959947969062291389551067",
                "55934673431409329499649700728963886501",
                "96097763901391590463459241697689786610",
                "261232351417802941098025188919101998925",
                "225270640421991475024335729423979823876",
                "337171319350645521134229371548994057999",
                "27683884360191112757439647161657373428",
                "304277588485205937585578616553339085031"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-128019-0c9588f8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "65118505193037535945095438604741048472",
            "length": 262
        },
        "id": "CVE-2026-128019-2b604c00",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_dup_env"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "201483379083728667205256956302007430325",
            "length": 119
        },
        "id": "CVE-2026-128019-32541a8f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_shutdown_dummy_request"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "110584076155258754007147506844086504521",
            "length": 822
        },
        "id": "CVE-2026-128019-6a821f9c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "PHP_FUNCTION"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231153875923491617791263442526650007236",
            "length": 203
        },
        "id": "CVE-2026-128019-837a4526",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "reset_sandboxed_environment"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "8201018770133958710253969815126229191",
            "length": 355
        },
        "id": "CVE-2026-128019-a75cb793",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "get_full_env"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231078220491626190999931205135930191875",
            "length": 162
        },
        "id": "CVE-2026-128019-b84b3c41",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_merge_with_prepared_env"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "94605501273072098551848618191881177492",
            "length": 349
        },
        "id": "CVE-2026-128019-c677a6ab",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_lookup_env"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "33402526722042561403015784242260791508",
            "length": 870
        },
        "id": "CVE-2026-128019-f041c044",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_worker_request_shutdown"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:32Z"