# CVE-2026-121737: Meta proxygen use-after-free in HTTP session handling

Source: https://junglewise.ai/threats/cve-2026-121737-when-a-remote-unauthenticated-http-1-1-client-pipelined-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-121737 · Severity: info · Published 2026-11-11

Meta's proxygen is an HTTP server library used by web services to handle client connections. When an unauthenticated client sends pipelined HTTP requests and stops reading mid-stream, a race condition can cause the server to use freed memory. This leads to server crashes and potential denial of service, with possible memory corruption allowing further attacks.

Technologies: [Meta Proxygen](https://junglewise.ai/threats/technologies/meta-proxygen). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta).

## Quick answers

**Is CVE-2026-121737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121737 being exploited in the wild.

**How severe is CVE-2026-121737?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Meta Proxygen before v2026.11.09.00.

**Is there a fix for CVE-2026-121737?** Yes: fixed in v2026.11.09.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121737 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121737?** Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v2026.11.09.00

## Technical details

A use-after-free vulnerability exists in proxygen's coroutine-based HTTP session handling when processing pipelined HTTP/1.1 requests. An unauthenticated remote attacker can trigger the flaw by pipelining a second request start and then stopping reads, causing the session to free a stream while resetting connection streams on write timeout, then reuse the freed stream. This affects all versions before v2026.11.09.00 and requires only network access with no authentication.

## Affected products

- Meta proxygen before v2026.11.09.00

## Timeline

- 2026-11-11: disclosed
- 2026-11-09: patched

## References

- [https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781](https://github.com/meta/proxygen/commit/daf245bba7fe1304b9491403fe56f91153299781)
- [https://www.facebook.com/security/advisories/cve-2026-121737](https://www.facebook.com/security/advisories/cve-2026-121737)

## Related threats

- [Meta proxygen HTTP/3 denial of service in QPACK handling](https://junglewise.ai/threats/cve-2026-119237-in-proxygen-s-http-3-session-when-a-headers-block-referenced)
- [proxygen QPACK decoder unbounded buffering denial of service](https://junglewise.ai/threats/cve-2026-119235-proxygen-s-qpack-decoder-enforced-its-size-limit-on-a-string)
- [Meta proxygen HTTP/3 denial of service in frame buffering](https://junglewise.ai/threats/cve-2026-119233-proxygen-s-http-3-codec-buffered-an-incomplete-non-data-frame)
- [Meta proxygen use-after-free in stream cleanup](https://junglewise.ai/threats/cve-2026-91096-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00)
- [Meta proxygen use-after-free in WebTransport stream handling](https://junglewise.ai/threats/cve-2026-91095-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00-the)