Medium severity · published Sep 28, 2026
CVE-2026-91095
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles…
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
proxygen · Facebook
v2024.10.28.00 before v2026.09.28.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91095
x_refsource_CONFIRM
https://www.facebook.com/security/advisories/cve-2026-91095
x_refsource_MISC
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
More from proxygen
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2020-1897
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence
9.8
CVE-2019-11940
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading…
9.8
CVE-2019-11921
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in…
7.5
CVE-2026-91096
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister…