CVE-2026-91096: Use After Free
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.
Affected Software
Event History
Frequently Asked Questions
Which releases are affected?
Meta Proxygen versions from v2024.10.28.00 through v2026.09.28.00 are affected. Releases before v2025.08.18.00 contain the vulnerable logic in WebTransportImpl::destroy; later affected releases use WebTransportImpl::terminateSessionStreams.
What condition triggers the use-after-free?
The issue occurs when streams are no longer open and are destroyed without their read callbacks being unregistered. The transport may subsequently invoke one of those freed read callbacks.