Threats Tagged 'ghsa-8mv4-xrj3-xg7m'

CVE-2026-91096 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2024.10.28.00 up to but not including 2026.09.28.00. The issue arises because the WebTransportImpl component fails to unregister read callbacks for streams that are no longer open before destroying them, potentially allowing the transport to invoke a freed read callback. This vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant impact on confidentiality without affecting integrity or availability.