Threats affecting pkg:github/php/frankenphp

CVE-2026-128027 is a critical vulnerability in php frankenphp Docker images prior to version 1.1.11. These images were rebuilt only when new base image tags were created, causing security fixes in underlying components like Alpine, PHP, and Go to not be applied. This allowed remote attackers to exploit known flaws in stale system libraries, such as CVE-2025-15467 in libcrypto3, potentially leading to remote code execution.

FrankenPHP versions before 1.13.4 have an information disclosure vulnerability in worker mode. The vulnerability arises because HTTP stream response headers are not cleared between requests, allowing subsequent requests on the same worker thread to access headers from previous requests. This can expose sensitive headers such as Set-Cookie or tokens from backend APIs to other users.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.