CVE-2026-91096

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams WebTransportImpl::destroy in releases before v2025.08.18.00 failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read...

CVE-2026-91096

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams WebTransportImpl::destroy in releases before v2025.08.18.00 failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read...

CVE-2026-91096

A flaw in proxygen (versions v2024.10.28.00 until v2026.09.28.00) allows a use-after-free condition. The WebTransportImpl::terminateSessionStreams function (or WebTransportImpl::destroy in releases before v2025.08.18.00) fails to unregister read callbacks for closed streams before destroying them...

PT-2026-102369

Name of the Vulnerable Software and Affected Versions proxygen versions 2024.10.28.00 through 2026.09.28.00 Description A use-after-free issue exists where the WebTransportImpl::terminateSessionStreams function known as WebTransportImpl::destroy in versions prior to 2025.08.18.00 fails to...