# CVE-2026-84895: Facebook Proxygen use-after-free in QuicWtSession closeSession

Source: https://junglewise.ai/threats/cve-2026-84895-in-proxygen-from-v2026-04-06-00-until-v2026-09-28-00  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-84895 · Severity: info · Published 2026-09-28

Facebook's Proxygen is an HTTP/QUIC networking library used in web servers and clients. A code sequencing flaw in the QuicWtSession closeSession method can cause it to access memory after the session object has been destroyed, potentially leading to crashes or undefined behavior in services that depend on this library.

Technologies: [Facebook Proxygen](https://junglewise.ai/threats/technologies/proxygen). Vendors: [Facebook](https://junglewise.ai/threats/vendors/facebook).

## Quick answers

**Is CVE-2026-84895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84895 being exploited in the wild.

**How severe is CVE-2026-84895?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** Facebook Proxygen v2026.04.06.00 to v2026.09.28.00.

**Is there a fix for CVE-2026-84895?** A patch was published on 2026-09-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84895 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-84895?** Check whether you run Facebook Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

QuicWtSession::closeSession accesses member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies a session handler, which may release the final reference to the session object and deallocate it, resulting in a use-after-free condition. This is a local logic flaw requiring no network interaction or authentication, triggered during normal session teardown.

## Affected products

- Facebook Proxygen v2026.04.06.00 to v2026.09.28.00

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched

## References

- [https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083](https://github.com/facebook/proxygen/commit/479eb5574195764e80e6cedebef669f6baa85083)
- [https://www.facebook.com/security/advisories/cve-2026-84895](https://www.facebook.com/security/advisories/cve-2026-84895)

## Related threats

- [Facebook Proxygen denial of service via slow-consumer memory exhaustion](https://junglewise.ai/threats/cve-2026-44909-facebook-proxygen-denial-of-service-via-slow-consumer-memory)
- [Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in…](https://junglewise.ai/threats/cve-2025-55181-sending-an-http-request-response-body-with-greater-than-2-31)