CVE-2026-24894: FrankenPHP leaks session data between requests in worker mode

February 12, 2026

When running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called.

References

github.com/advisories/GHSA-r3xh-3r3w-47gp
github.com/php/frankenphp
github.com/php/frankenphp/commit/24d6c991a7761b638190eb081deae258143e9735
github.com/php/frankenphp/releases/tag/v1.11.2
github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp
nvd.nist.gov/vuln/detail/CVE-2026-24894

Code Behaviors & Features

Detect and mitigate CVE-2026-24894 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →