Facebook Proxygen vulnerabilities

CVEs per yearBy the year they were published

1. 20183
2. 20192
3. 20201
4. 20211
5. 20251
6. 20264

Newest CVEs

• CVE-2026-91096

  In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…

  Facebook · proxygen

  High7.5
• CVE-2026-91095

  In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…

  Facebook · proxygen

  Medium5.3
• CVE-2026-84895

  In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…

  Facebook · proxygen

  High7.3
• CVE-2026-44909

  Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…

  Facebook · proxygen

  High7.5
• CVE-2025-55181

  Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…

  Facebook · proxygen

  Medium5.3
• CVE-2021-24029

  A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC…

  Facebook · mvfst

  High7.5
• CVE-2020-1897

  A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific…

  Facebook · proxygen

  Critical9.8
• CVE-2019-11940

  In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a…

  Facebook · Proxygen

  Critical9.8
• CVE-2019-11921

  An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing…

  Facebook · Proxygen

  Critical9.8
• CVE-2018-6347

  An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.

  Facebook · Proxygen

  High7.5