CVE-2026-91096 - In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them

Back Back to CVE browser

HIGH

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them

Published Sep 28, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.26%

Description

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.

Affected products

Vendor Facebook Product Proxygen Default
unaffected
- Version
  v2024.10.28.00
  Status
  affected
  Constraints
  <v2026.09.28.00

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

Proxygen

unaffected

Version	Status	Constraints
v2024.10.28.00	affected	<v2026.09.28.00

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88545
Advisory
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083
x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2026-91096
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88545		Advisory
https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083		x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2026-91096		x_refsource_CONFIRM