Threats affecting pkg:golang/frankenphp

CVE-2026-122233 is an information disclosure vulnerability in FrankenPHP versions before 1.13.4. The flaw occurs in worker mode where the last HTTP stream response headers are not cleared between requests because the reset only happens during RSHUTDOWN, which worker requests skip. This allows subsequent requests on the same worker thread to access headers from previous requests, potentially exposing sensitive headers such as Set-Cookie or tokens from backend APIs.