[ CVE-2026-91096 · Published 28 Sep 2026 ]
Vulnerability in Facebook proxygen
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.