Is CVE-2026-121737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121737 being exploited in the wild.

How severe is CVE-2026-121737?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Meta Proxygen before v2026.11.09.00.

Is there a fix for CVE-2026-121737?

Yes: fixed in v2026.11.09.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121737 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121737?

Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121737: Meta proxygen use-after-free in HTTP session handling

CVE-2026-121737 · Severity: info · Published 2026-11-11

Meta's proxygen is an HTTP server library used by web services to handle client connections. When an unauthenticated client sends pipelined HTTP requests and stops reading mid-stream, a race condition can cause the server to use freed memory. This leads to server crashes and potential denial of service, with possible memory corruption allowing further attacks.

Technologies: Meta Proxygen. Vendors: Meta.

Quick answers

Is CVE-2026-121737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121737 being exploited in the wild.
How severe is CVE-2026-121737?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Meta Proxygen before v2026.11.09.00.
Is there a fix for CVE-2026-121737?: Yes: fixed in v2026.11.09.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121737 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121737?: Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v2026.11.09.00

Technical details

A use-after-free vulnerability exists in proxygen's coroutine-based HTTP session handling when processing pipelined HTTP/1.1 requests. An unauthenticated remote attacker can trigger the flaw by pipelining a second request start and then stopping reads, causing the session to free a stream while resetting connection streams on write timeout, then reuse the freed stream. This affects all versions before v2026.11.09.00 and requires only network access with no authentication.

Affected products

Meta proxygen before v2026.11.09.00

Timeline

2026-11-11: disclosed
2026-11-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.