I think we should return 5xx for an invalid request.

Invalid SCRIPT_FILENAME is already returning 404 so this is much more consistent. Also this is a client error so this needs to be 4xx. 5xx is for server errors...

Why is that script_path_translated check there at all? The comment says it allows specifying the script via argv, but I don't think FPM supports that, right? This code was copy&pasted from init_request_info in sapi/cgi/cgi_main.c, and I think the condition was just copied over even though it does not make sense in the FPM context.

The check seems to be mostly useful to save some cycles as the processing can basically end if it's null and request_method is set because then it will be early return from the request (200 with empty content if request_method is null or 404 if script_path_translated is null). Guess it would be probably better to just do

if (!script_path_translated) {
    return;
}

but that's more minor optimization unrelated to the fix...

Comment updated and merged via a221e17

Hello. Could you say, please, in what release it will be included? 7.3, 7.4, 8.0?

upd: Oh, I see a php:PHP-7.4 tile on the top. Never mind!

Many thanks for the fix!