GO-2026-4486
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/dunglas/frankenphp | 0 | 1.11.2 |
Related vulnerabilities
- CVE-2026-24895 FrankenPHP is a modern application server for PHP. Same vulnerability
- CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/dunglas/frankenphp
- GO-2026-4442 FrankenPHP has delayed propagation of security fixes in upstream base images in… Also affects github.com/dunglas/frankenphp
- GO-2026-4489 FrankenPHP leaks session data between requests in worker mode in… Also affects github.com/dunglas/frankenphp
- CVE-2026-24894 FrankenPHP is a modern application server for PHP. Also affects github.com/dunglas/frankenphp