Threats affecting pkg:github/meta/proxygen

CVE-2026-121737 is a use-after-free vulnerability in Facebook's proxygen HTTP library. It occurs when an unauthenticated HTTP/1.1 client pipelines a second request and then stops reading, causing proxygen's coroutine-based HTTP session to free the pipelined stream during a write timeout reset and subsequently use the freed memory. This can crash the server, resulting in denial of service, and may lead to memory corruption with further impact. The issue affects proxygen versions prior to v2026.11.09.00.

A vulnerability in Facebook's proxygen HTTP/3 session handling allows a remote unauthenticated attacker to cause excessive memory and CPU usage by sending specially crafted HEADERS blocks referencing QPACK dynamic table entries that are never received. This leads to denial of service due to resource exhaustion. The issue affects proxygen versions prior to v2026.11.09.00 and is fixed in that version.

CVE-2026-119235 is a vulnerability in Facebook's proxygen library affecting its QPACK decoder. The decoder enforces size limits on string literals only after fully receiving them, allowing a remote unauthenticated HTTP/3 peer to send an insert instruction declaring an arbitrarily large literal. This causes unbounded buffering in the decoder, exhausting memory and resulting in a denial of service. The issue affects proxygen versions before v2026.11.09.00.

CVE-2026-119233 is a vulnerability in Facebook's proxygen HTTP/3 codec where it buffers incomplete non-DATA frames without limiting their declared length. This allows a remote, unauthenticated HTTP/3 peer to declare a very large frame and deliver it slowly, causing unbounded memory growth and CPU usage that increases quadratically with the number of fragments. This can lead to a denial of service. The issue affects proxygen versions prior to v2026.11.09.00 and is fixed in version v2026.11.09.00.