proxygen vulnerabilities

2 known vulnerabilities in proxygen from Facebook. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  proxygen: Use After Free

  CVE-2026-91096Sep 28, 2026Facebook

  In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The t

• 7.3 High severity

  proxygen: Use After Free

  CVE-2026-84895Sep 28, 2026Facebook

  In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to th