Facebook Proxygen
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Facebook Proxygen.
By the Year
In 2026 there have been 0 vulnerabilities in Facebook Proxygen. Last year, in 2025 Proxygen had 1 security vulnerability published. Right now, Proxygen is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 5.30 |
| 2024 | 0 | 0.00 |
| 2023 | 1 | 7.50 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 7.50 |
| 2020 | 1 | 9.80 |
| 2019 | 2 | 9.80 |
| 2018 | 1 | 7.50 |
It may take a day or so for new Proxygen vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Facebook Proxygen Security Vulnerabilities
Unbounded Memory Growth in Proxygen via Infinite Loop on Large HTTP Body
CVE-2025-55181
5.3 - Medium
- December 02, 2025
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
Excessive Iteration
HTTP/2 DoS via Stream Reset in nginx
CVE-2023-44487
7.5 - High
- October 10, 2023
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Resource Exhaustion
A packet of death scenario is possible in mvfst
CVE-2021-24029
7.5 - High
- March 15, 2021
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
assertion failure
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence
CVE-2020-1897
9.8 - Critical
- May 18, 2020
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.
Dangling pointer
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations
CVE-2019-11940
9.8 - Critical
- December 04, 2019
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.
Dangling pointer
An out of bounds write is possible
CVE-2019-11921
9.8 - Critical
- July 25, 2019
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
Memory Corruption
Proxygen fails to validate that a secondary auth manager is set before dereferencing it
CVE-2018-6343
7.5 - High
- December 31, 2018
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Facebook Proxygen or by Facebook? Click the Watch button to subscribe.
