CVE-2026-128021
Deferred Deferred - Pending Action

FrankenPHP Information Disclosure via Unreset libxml Errors

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128021
EUVD
EUVD-2026-125081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frankenphp frankenphp to 1.13.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.13.2 has an information disclosure vulnerability in worker mode where LIBXML error lists are not reset between requests. This allows later clients to access earlier clients' libxml errors, potentially exposing parsed-document fragments and server filesystem paths.

Detection Guidance

This vulnerability can be detected by checking if multiple clients are sharing the same worker thread in FrankenPHP and if libxml errors from one client are accessible to another. Monitor for unexpected access to libxml error logs or parsed-document fragments.

Impact Analysis

Attackers could exploit this to read sensitive data from other users' requests, including document contents or server paths. This could lead to unauthorized access to confidential information if exploited.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal or sensitive data to unauthorized parties. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.2 or later to address the vulnerability. Ensure worker threads are properly isolated and reset between requests to prevent information leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...