CVE-2026-91096 describes a use-after-free vulnerability in the proxygen library maintained by Facebook. Specifically, in versions from 2024.10.28.00 until 2026.09.28.00, the WebTransportImpl::terminateSessionStreams method (and WebTransportImpl::destroy in versions before 2025.08.18.00) does not properly unregister read callbacks for streams that have been closed before destroying those streams. This flaw can cause the transport layer to invoke a read callback that has already been freed, leading to undefined behavior and potential memory corruption.

The vulnerability could lead to memory corruption due to use-after-free conditions when read callbacks are invoked after their associated streams have been destroyed. This may result in application crashes or potentially exploitable conditions depending on the context in which proxygen is used. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor the vendor's advisories for updates and apply any official fixes once available.