Meta Proxygen v2024.10.28.00-2026.09.28.00 UAF HTTPTransaction::onWebTransport
CVE-2026-91095 Published on September 28, 2026
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
Vulnerability Analysis
CVE-2026-91095 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-91095 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-91095
Want to know whenever a new CVE is published for Facebook Proxygen? stack.watch will email you.
Affected Versions
Facebook proxygen:- Version v2024.10.28.00 and below v2026.09.28.00 is affected.