CVE-2026-91095 — In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed

Back Back to CVE browser

MEDIUM

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed

Published Sep 28, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.25%

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.

Affected products

Vendor Facebook Product Proxygen Default
unaffected
- Version
  v2024.10.28.00
  Status
  affected
  Constraints
  <v2026.09.28.00

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

Proxygen

unaffected

Version	Status	Constraints
v2024.10.28.00	affected	<v2026.09.28.00

Remediation

No remediation recorded yet.

Metrics

0.25% 0.00247

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00247

Score over time

Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.25% (0.00247)	14.50th	v5 (v2026.06.15)
Oct 1, 2026	0.25% (0.00247)	14.42th	v5 (v2026.06.15)

Weaknesses (1)

CWE-416

Use After Free

References (2)

https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2026-91095
x_refsource_CONFIRM

Link	Providers	Tags
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083		x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2026-91095		x_refsource_CONFIRM