CVE-2026-91096 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2024.10.28.00 up to but not including 2026.09.28.00. The issue arises because the WebTransportImpl component fails to unregister read callbacks for streams that are no longer open before destroying them, potentially allowing the transport to invoke a freed read callback. This vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant impact on confidentiality without affecting integrity or availability.
CVE-2026-91095 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2024.10.28.00 up to but not including 2026.09.28.00. The issue arises when certain HTTPTransaction APIs return stream handles that have already been freed, leading to potential use of freed memory. This flaw could cause application instability or crashes but does not impact confidentiality or integrity.
CVE-2026-84895 is a use-after-free vulnerability in Facebook's proxygen library affecting versions from 2026.04.06.00 up to but not including 2026.09.28.00. The issue occurs when QuicWtSession::closeSession accesses member fields after the base class method QuicWtSessionBase::closeSession potentially destroys the session object. This can lead to memory corruption and impacts confidentiality, integrity, and availability.
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
CVE-2026-66705 is a high-severity vulnerability in Facebook for WordPress versions up to and including 5.2.1. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability could lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently available from the vendor.
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected.
CVE-2026-49059 is an Open Redirect vulnerability in Facebook for WooCommerce that allows URL redirection to untrusted sites, which can facilitate phishing attacks. The vulnerability affects versions up to 3.7.0. It has a CVSS 3.1 base score of 4.7, indicating medium severity. There is no official patch or remediation level currently provided by the vendor. No known exploits in the wild have been reported.
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
CVE-2025-55179 is a medium severity vulnerability in WhatsApp Business for iOS and related WhatsApp clients that allows incorrect authorization due to incomplete validation of rich response messages. This flaw could enable a user to cause another user’s device to process media content from an arbitrary URL without proper authorization. The vulnerability affects WhatsApp for iOS versions prior to 2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.
A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.
