Meta Proxygen before 2026.11.09.00 - Use-after-free leads to DoS
CVE-2026-121737 Published on November 11, 2026
When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could free that pipelined stream while resetting the connection's streams on the resulting write timeout, then go on to use it. This can crash the server, leading to denial of service, and may allow memory corruption with further impact. This issue affects proxygen versions prior to v2026.11.09.00.
Products Associated with CVE-2026-121737
Want to know whenever a new CVE is published for Facebook Proxygen? stack.watch will email you.
Affected Versions
Facebook proxygen:- Version v0.0.0.0 and below v2026.11.09.00 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.