dunglas vulnerabilities

Products

• github.com/dunglas/frankenphp 6
• github.com/dunglas/mercure 1

Latest dunglas CVEs

Newest publication first

1. CVE-2026-122233 FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

   Published 2026-11-04

   Medium·CVSS 6.3 EPSS 0.23%

   FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_...

2. CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

   Published 2026-10-13

   High·CVSS 7.7 EPSS 0.29%

   FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuratio...

3. CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

   Published 2026-06-10

   High·CVSS 8.1 EPSS 0.71%

   FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an a...

4. CVE-2026-39972 Mercure has a Topic Selector Cache Key Collision

   Published 2026-04-09

   High·CVSS 7.1 EPSS 0.32%

   Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to...

5. CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files

   Published 2026-02-12

   High·CVSS 8.9 EPSS 0.64%

   FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that...

6. CVE-2026-24894 FrankenPHP leaks session data between requests in worker mode

   Published 2026-02-12

   High·CVSS 8.7 EPSS 0.49%

   FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previou...

7. GHSA-x9p2-77v6-6vhf FrankenPHP has delayed propagation of security fixes in upstream base images

   Published 2026-02-05

   Critical·CVSS 9.8

   Delayed propagation of security fixes in upstream base images Summary Vulnerability in base Docker images (PHP, Go, and Alpine) not automatically propagating to FrankenPHP images. FrankenPHP's container images were previously built only when specific version tags were updated or...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.