CVE-2026-84894: Meta Platforms, Inc Moxygen

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.

Affected products

• Meta Platforms, Inc Moxygen

Published 2026-09-28. Last modified 2026-09-30.