Is CVE-2026-91095 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91095 being exploited in the wild.

How severe is CVE-2026-91095?

Informational severity, published 28 September 2026.

Which products and versions are affected?

Meta Proxygen v2024.10.28.00 to v2026.09.28.00.

Is there a fix for CVE-2026-91095?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91095 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91095?

Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91095: Meta proxygen use-after-free in WebTransport stream handling

CVE-2026-91095 · Severity: info · Published 2026-09-28

Meta's proxygen HTTP library contains a use-after-free vulnerability in its WebTransport stream handling. The HTTPTransaction APIs could return stream handles that had already been freed by the stream handler, and these dangling pointers were then used as transport read callbacks. This could allow an attacker to corrupt memory or trigger a crash when processing WebTransport connections.

Technologies: Meta Proxygen. Vendors: Meta.

Quick answers

Is CVE-2026-91095 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91095 being exploited in the wild.
How severe is CVE-2026-91095?: Informational severity, published 28 September 2026.
Which products and versions are affected?: Meta Proxygen v2024.10.28.00 to v2026.09.28.00.
Is there a fix for CVE-2026-91095?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91095 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91095?: Check whether you run Meta Proxygen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs, which return stream handles that have already been freed by the stream handler. HQSession installs these dangling pointers as transport read callbacks, leading to use-after-free when those callbacks are invoked. The issue affects proxygen versions from v2024.10.28.00 to v2026.09.28.00; a patch is available in v2026.09.28.00 and later.

Affected products

Meta proxygen v2024.10.28.00 to v2026.09.28.00

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.