CVE-2026-91096: Facebook Proxygen

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.

Affected products

• Facebook Proxygen: from v2024.10.28.00, before v2026.09.28.00 (fixed in v2026.09.28.00)

Published 2026-09-28. Last modified 2026-09-30.