Is CVE-2026-82416 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82416 being exploited in the wild.

How severe is CVE-2026-82416?

High severity, with a CVSS score of 7.7, published 13 October 2026.

Which products and versions are affected?

FrankenPHP all versions when compiled against PHP with session as a shared module; github.com/dunglas/frankenphp (Go) <= 1.12.4, SEMVER:introduced=0,fixed=1.12.5.

How is CVE-2026-82416 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82416?

Check whether you run FrankenPHP or github.com/dunglas/frankenphp (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82416: FrankenPHP cross-request session ID leak in worker mode

Q: Is there a fix for CVE-2026-82416?

Yes. github.com/dunglas/frankenphp (Go): upgrade to 1.12.5 or later. Until then: Use a FrankenPHP build compiled against PHP with the session extension statically linked (such as the official static binaries or Docker images). Alternatively, in the worker request loop after `session_write_close()`, explicitly call `session_id('')` so that the next `session_start()` re-reads the request cookie; enable `session.use_strict_mode=1` to enforce session validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82416 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-82416?

Check whether you run FrankenPHP or github.com/dunglas/frankenphp (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82416 · Severity: high · CVSS 7.7 · Published 2026-10-13

FrankenPHP is an application server that runs PHP in worker threads. When the PHP session extension is loaded as a shared module (common in packaged distributions), a session ID from one user's request can leak to another concurrent user, or a user can receive a stale session from a previous request. An attacker could hijack another user's session or cause users to be intermittently logged out and served incorrect sessions.

Technologies: github.com/dunglas/frankenphp (Go). Vendors: Go.

Quick answers

Is CVE-2026-82416 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82416 being exploited in the wild.
How severe is CVE-2026-82416?: High severity, with a CVSS score of 7.7, published 13 October 2026.
Which products and versions are affected?: FrankenPHP all versions when compiled against PHP with session as a shared module; github.com/dunglas/frankenphp (Go) <= 1.12.4, SEMVER:introduced=0,fixed=1.12.5.
Is there a fix for CVE-2026-82416?: Yes. github.com/dunglas/frankenphp (Go): upgrade to 1.12.5 or later. Until then: Use a FrankenPHP build compiled against PHP with the session extension statically linked (such as the official static binaries or Docker images). Alternatively, in the worker request loop after `session_write_close()`, explicitly call `session_id('')` so that the next `session_start()` re-reads the request cookie; enable `session.use_strict_mode=1` to enforce session validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82416 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82416?: Check whether you run FrankenPHP or github.com/dunglas/frankenphp (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/dunglas/frankenphp (Go): upgrade to 1.12.5 or later
```
go get github.com/dunglas/frankenphp@v1.12.5
```

Use a FrankenPHP build compiled against PHP with the session extension statically linked (such as the official static binaries or Docker images). Alternatively, in the worker request loop after `session_write_close()`, explicitly call `session_id('')` so that the next `session_start()` re-reads the request cookie; enable `session.use_strict_mode=1` to enforce session validation.

Technical details

The vulnerability is a request-state cleanup bug in the session extension's global state reset. FrankenPHP's session state reset function is guarded by `HAVE_PHP_SESSION`, a macro only defined when the session extension is statically linked at compile time. When the extension is loaded as a shared module, the reset is compiled out, leaving `PS(id)` stale across request boundaries. Subsequent `session_start()` calls skip reading the request cookie if `PS(id)` is non-NULL, reusing the previous request's session ID for whichever client is served next by the same worker thread. No authentication is required; any client can trigger this by sending session cookies concurrently.

Affected products

FrankenPHP FrankenPHP all versions when compiled against PHP with session as a shared module

Identifiers

CVE-2026-82416
GHSA-v3ph-cgqh-r8p5
GO-2026-6797

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.