FrankenPHP leaks session data between requests in worker mode

QFinch assessment

When running FrankenPHP in worker mode, the $SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $SESSION data of the previous request (potentially belonging to a different user) before sessionstart() is called.

Potential impact

This is a cross-request data leakage vulnerability. Confidentiality: If an application reads $SESSION before calling sessionstart(), it can access sensitive information (authentication tokens, user IDs, PII) belonging to the previous user. Logic Errors / Impersonation: If application logic relies on $SESSION being empty or unset to detect a "guest" state, or checks for specific keys in $SESSION prior to session initialization, a malicious actor (or accidental race condition) could trigger privilege escalation or user impersonation. This affects only users running FrankenPHP in worker mode and not sessionstart() for each request, which is done by default by most frameworks.

Technical context

In standard PHP execution, the environment is torn down completely after every request. In FrankenPHP's worker mode, the application stays in memory, and superglobals are manually reset between requests. The vulnerability exists because $SESSION is stored in the Zend Engine's symbol table (EG(symboltable)). While the standard PHP request shutdown (RSHUTDOWN) decrements the reference count of the session data, it does not remove the $SESSION variable itself from the symbol table. FrankenPHP's reset logic (frankenphpresetsuperglobals) previously cleared other superglobals but failed to explicitly delete $SESSION. Consequently, until sessionstart() is called in the new request (which re-initializes the variable), the $SESSION array retains the data from the previous request processed by that specific worker thread.