Threats affecting pkg:github/meta/mvfst

A vulnerability in Facebook's mvfst QUIC server allows a remote unauthenticated client to cause unbounded memory growth by sending Handshake-level CRYPTO data after the TLS handshake has progressed, leading to denial of service. This affects mvfst versions prior to v2026.11.09.00. The issue arises because the server retains CRYPTO frame data at encryption levels already passed by the handshake and does not count this data against buffer limits.

A vulnerability in Facebook's mvfst prior to version 2026.11.09.0 allows a remote unauthenticated QUIC peer to cause excessive memory consumption and CPU usage by sending many small, non-contiguous stream fragments. This happens because mvfst does not properly merge or compact out-of-order STREAM frame data, leading to denial of service.