—

GO-2026-4486

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp

Quick fix

GO-2026-4486 — github.com/dunglas/frankenphp: upgrade to the fixed version with the command below.

go get github.com/dunglas/frankenphp@v1.11.2

Details

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/dunglas/frankenphp

Introduced in: 0Fixed in: 1.11.2

Fixgo get github.com/dunglas/frankenphp@v1.11.2

References

https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-24895[ADVISORY]
https://github.com/php/frankenphp/commit/04fdc0c1e8fde94e2c1ad86217e962c88d27c53e[WEB]
https://github.com/php/frankenphp/releases/tag/v1.11.2[WEB]