CVE-2026-24894: FrankenPHP leaks session data between requests in worker mode

February 12, 2026

When running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called.

References

github.com/advisories/GHSA-r3xh-3r3w-47gp
github.com/php/frankenphp
github.com/php/frankenphp/commit/24d6c991a7761b638190eb081deae258143e9735
github.com/php/frankenphp/releases/tag/v1.11.2
github.com/php/frankenphp/security/advisories/GHSA-r3xh-3r3w-47gp
nvd.nist.gov/vuln/detail/CVE-2026-24894

Code Behaviors & Features

Detect and mitigate CVE-2026-24894 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →