- Latest release
- v1.13.5 (Nov 5, 2026): no advisory affects it
- Newest unaffected release
- v1.13.5 (Nov 5, 2026), the latest release
- Advisories
- 4 · 4 high
- Releases
- 62 since v1.0.0 (Dec 7, 2023)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-82416Affects v1.0.0-beta.1 to v1.12.4 (v1.12.5 is outside it)
- CVE-2026-45062Affects v1.11.2 to v1.12.2 (v1.12.3 is outside it)
- CVE-2026-24895Affects v1.0.0-beta.1 to v1.11.1 (v1.11.2 is outside it)
- CVE-2026-24894Affects v1.0.0-beta.1 to v1.11.1 (v1.11.2 is outside it)
Advisories 4
- CVE-2026-82416High 7.7
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Affected: fixed in 1.12.5.
Fixed in v1.12.5 (released Jul 18, 2026, 87 days before disclosure).
The latest release, v1.13.5, is not affected.
- CVE-2026-45062High 8.1
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
Affected: from 1.11.2, fixed in 1.12.3.
Fixed in v1.12.3 (released May 15, 2026, 26 days before disclosure).
The latest release, v1.13.5, is not affected.
- CVE-2026-24895High 8.9
FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
Affected: fixed in 1.11.2.
Fixed in v1.11.2 (released Feb 12, 2026, the day of disclosure).
The latest release, v1.13.5, is not affected.
- CVE-2026-24894High 8.7
FrankenPHP leaks session data between requests in worker mode
Affected: fixed in 1.11.2.
Fixed in v1.11.2 (released Feb 12, 2026, the day of disclosure).
The latest release, v1.13.5, is not affected.