CVE-2026-91095

The proxygen framework, versions v2024.10.28.00 through v2026.09.28.00 , contains a memory safety vulnerability. The HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs may return stream handles that the stream handler has already freed. Consequently, HQSes...

EUVD-2026-88544

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which...