mvfst versions prior to v2026.11.09.0 have a vulnerability where out-of-order STREAM frame data is not adequately merged or compacted. This allows a remote, unauthenticated QUIC peer to send many small, non-contiguous stream fragments, causing excessive memory consumption and increased CPU usage on the target, potentially leading to denial of service.