CVE-2026-91095

Deferred Deferred - Pending Action

Use After Free in Proxygen HTTPTransaction APIs

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Facebook, Inc.

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-91095

Affected Vendors & Products

Vendor	Product	Version / Range
facebook	proxygen	From 2024.10.28.00 (inc) to 2026.09.28.00 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in proxygen versions between v2024.10.28.00 and v2026.09.28.00. The HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs incorrectly return stream handles that were already freed by the stream handler. This causes HQSession to install these invalid handles as transport read callbacks, leading to potential use of freed memory.

Detection Guidance

This vulnerability is specific to proxygen versions between v2024.10.28.00 and v2026.09.28.00. Detection involves checking the installed version of proxygen. If you are using a vulnerable version, update to the latest non-vulnerable version immediately.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or unexpected behavior in applications using affected proxygen versions. Attackers might exploit it to execute arbitrary code, escalate privileges, or cause denial of service by triggering use-after-free conditions.

Mitigation Strategies

Update proxygen to a version beyond v2026.09.28.00 to address the use-after-free issue in HTTPTransaction APIs.

Hi! I’m here to help you understand CVE-2026-91095. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70