NIXPKGS-2026-0229
GitHub issue
published on 15 Feb 2026
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
FrankenPHP leaks session data between requests in worker mode
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
References
-
https://github.com/php/frankenphp/releases/tag/v1.11.2 x_refsource_MISC
-
https://github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp x_refsource_CONFIRM
Affected products
frankenphp
- ==< 1.11.2
Package maintainers
-
@gaelreyrol Gaël Reyrol <me@gaelreyrol.dev>
-
@shyim Soner Sayakci <s.sayakci@gmail.com>