CVE-2026-91095: Use After Free
Published Sep 28, 2026
·Updated
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Affected Software
1 affected component
Meta Proxygen>=2024.10.28.00<2026.09.28.00
Event History
Sep 28, 2026
CVE Published
via MITRE·08:44 PM
Data Sourced
via MITRE·08:44 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Proxygen versions are affected?
The issue affects Proxygen from v2024.10.28.00 through v2026.09.28.00.
2
What conditions are needed to trigger the vulnerability?
The condition occurs when HTTPTransaction::onWebTransportUniStream or HTTPTransaction::onWebTransportBidiStream returns a stream handle that its stream handler has already freed. HQSession can then register that stale handle as a transport read callback, resulting in use of freed memory.