CVE-2026-122233

Name of the Vulnerable Software and Affected Versions FrankenPHP versions prior to 1.13.4

Description In worker mode, the software fails to clear the last HTTP stream response headers between requests. This occurs because the reset process only happens during RSHUTDOWN, a phase that worker requests skip. Consequently, subsequent requests utilizing the http get last response headers() function can access headers from previous requests processed by the same worker thread, potentially exposing sensitive data such as Set-Cookie or token headers from backend APIs.

Recommendations Update to version 1.13.4 or later.