Frankenphp (Php) - vulnerabilities (CVEs)

5 CVEs, 2 in the last 30 days, 48 known versions, newest CVE from 2026-10-13. Vendor: Php.

CVEs of Frankenphp

• CVE-2026-85733 - CVSS 5.3 (medium), 2026-10-13: FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default…
• CVE-2026-82416 - CVSS 7.7 (high), 2026-10-13: FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session…
• CVE-2026-45062 - CVSS 8.1 (high), 2026-06-10: FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses…
• CVE-2026-24895 - CVSS 9.8 (critical), 2026-02-12: FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case…
• CVE-2026-24894 - CVSS 8.7 (high), 2026-02-12: FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset…