CVE-2026-84895: Facebook Proxygen

High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days.

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

Affected products

• Facebook Proxygen: from v2026.04.06.00, before v2026.09.28.00 (fixed in v2026.09.28.00)

Published 2026-09-28. Last modified 2026-10-01.