Skip to content
OpenAdvisories
High · 7.3 CVE-2026-84895 EUVD-2026-88543GHSA-ppxw-566f-wjp6

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtS…

Published Sep 28, 2026 · Updated Oct 1, 2026 · Assigned by Meta

Description

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

Affected products

VendorProductAffectedFixed
Facebook proxygen v2026.04.06.00 – < v2026.09.28.00 v2026.09.28.00

References