CVE-2026-91095

Deferred Deferred - Pending Action

Use After Free in Proxygen HTTPTransaction APIs

Publication date: 2026-09-28

Last updated on: 2026-09-30

Assigner: Facebook, Inc.

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-16

NVD

CVE-2026-91095

Affected Vendors & Products

Vendor	Product	Version / Range
facebook	proxygen	From 2024.10.28.00 (inc) to 2026.09.28.00 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in proxygen versions between v2024.10.28.00 and v2026.09.28.00. The HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs incorrectly return stream handles that were already freed by the stream handler. This causes HQSession to install these invalid handles as transport read callbacks, leading to potential use of freed memory.

Detection Guidance

This vulnerability is specific to proxygen versions between v2024.10.28.00 and v2026.09.28.00. Detection involves checking the installed version of proxygen. If you are using a vulnerable version, update to the latest non-vulnerable version immediately.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or unexpected behavior in applications using affected proxygen versions. Attackers might exploit it to execute arbitrary code, escalate privileges, or cause denial of service by triggering use-after-free conditions.

Compliance Impact

The vulnerability involves use of freed memory due to improper handling of stream handles in proxygen, which could lead to memory corruption or crashes. This may impact compliance with standards like GDPR or HIPAA by potentially exposing sensitive data through memory leaks or unauthorized access if exploited.

Mitigation Strategies

Update proxygen to a version beyond v2026.09.28.00 to address the use-after-free issue in HTTPTransaction APIs.

Hi! I’m here to help you understand CVE-2026-91095. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70