CVE-2026-91095In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction:
nWebTransportUniStream and HTTPTransaction:nWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.