High
Security advisory
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-84894
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:14 UTC · Revision 1
Source evidence
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
osv:CVE-2026-84894
Complete source record
{
"id": "c0b5748d1ddb7f5df03f242c0f20fb3718e481c505ef44bd074b7d357651805b",
"url": "https://osv.dev/vulnerability/CVE-2026-84894",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-84894",
"summary": "In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.",
"evidence": "osv:CVE-2026-84894",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-84894",
"aliases": [
"CVE-2026-84894"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebookexperimental/moxygen",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "004123dd24c3"
},
{
"fixed": "004123dd24c30dad6b649163575145f240dabc94"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "004123dd24c3"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "004123dd24c30dad6b649163575145f240dabc94"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"draft-12-stable",
"draft-08-stable",
"draft-07-stable"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84894.json",
"vanir_signatures": [
{
"id": "CVE-2026-84894-1d900b53",
"digest": {
"threshold": 0.9,
"line_hashes": [
"170911455317071165656593951946965204830",
"301265065837899781732992036484547666201",
"153320690110925779669964333532853794760",
"218545059036537395616170178461344686361",
"99857527424838480245131961382190893895",
"231649691860121436571327372752390295829",
"88796697806442171996789234546511947024",
"125062960545573178329924459624555313539",
"321556697423032579161759691339106254562",
"165449071393020916763908958264129990642",
"166684635912814243341374899383277459396",
"103324760454624561433280747620935777444",
"19221166480675779634224145652044306520",
"209962679788107213048582792139055026717",
"17093700932131512455133126788933259216",
"18279843521896459669542923272325763873",
"228617777500353824449627929395426551134",
"254444219817786317602537610059774007835",
"83157943276167125553037039351829365036",
"89629907532910060150759111752323882297",
"60342332080128759424029333600799624442",
"336732339966403960567388058804803594264",
"252819006966251769199157308355129519263",
"265692025606492618704107536204803850139",
"184026702705386057723223583286462509857",
"251173647230278461892017113652986114065",
"131940253864386300336927370980835576460",
"298658518914288335266414909877164126376",
"303275590206333832765985047839846059352",
"29008657001827757632286837760966608402",
"163863138908090549740089522650463863349"
]
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-52c5fddc",
"digest": {
"length": 860,
"function_hash": "95706840555774541445389021552469599307"
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.cpp",
"function": "MoQSession::start"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-886da4fe",
"digest": {
"length": 5417,
"function_hash": "175171028297742042403827175562649632095"
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.cpp",
"function": "MoQSession::dataStreamReadLoop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-8c8d079b",
"digest": {
"length": 338,
"function_hash": "240252167403251495327003432963066834081"
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.cpp",
"function": "MoQSession::replayBufferedUniStreams"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-e1a132a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"116064157752364120127044256065532112937",
"168356028759187871765557620750374388496",
"285051713362136633476969194282080335590",
"139094068760388895115187496263543201193",
"197638502205683391208516033622318195988",
"36067494397542370962147849282913282163",
"228262231594574289477962564729504863253",
"31004973350275383326738594648826241004",
"88952118965132652911048955663246172191",
"209373993888354168827904229475776070550",
"324136120167814752586114894985802299171",
"167574065071495678468760380618285455304",
"234522166588909370141379869343388364070",
"3417825256757713067363085030087163440",
"2930817482673789948707935684738720597",
"196698614801207663242670622054745584728",
"65232541594751473780254481423474103547",
"79843767564435069742505847348428492262",
"68251095292276152182580316070606748941",
"270837644963353435482380644353923734728",
"173944498167823562322381703934529645695",
"134048633296047832614687367827073442555",
"337304136068735690276064459921088235968",
"293888536654803295051524489265278799115",
"35360088918780068886731883084782896914",
"148345659287620765579935554464162751522",
"339142064214764134484148629177368962548",
"83966617481088740025753991054851872763",
"310878151631664825850425187761016897354",
"301248738644119165673987653721529920567",
"112026667377895240216606713168039200360",
"261866684564814774664409983666961313085",
"280398119183425792365719964989274808883",
"235312707224940096289006707370750955686",
"32851483680537449747193856144774732309",
"147219199955605414510205038330304918404",
"222406320318109941725591453246552265475",
"329569569490802243294187729704473035894",
"19423343993667381699775238147557768836",
"20947755527929099738859497474032010516",
"173519761810706116510004570889240443208",
"236413439755068012043151068500751118198",
"13544732443644060000695368152024170140",
"120255083445053991378415833094885884693",
"256830222290749618555318993145714113313",
"173050264452565536251823630748965874384",
"293427839941528973140626096740018618628",
"29981293004809514581804948047459057405",
"220312391073571808748616171652409859814",
"205910927733747691473219686389784472871",
"92159301404329137936336825017919740461",
"108277477408141254943383247117708643925",
"245438820501476174942615197537686707555",
"303903670985663166784371544428076664565",
"293199646868018827255110886358931201902",
"229473029529972440005294754244372326503",
"264084360453516594652469412948522439153",
"4149016065515882141411592799304994493",
"61373493538857058772144941822344631762",
"17466776015859234988941910738688542460",
"333899415829505552047061280969895096781",
"194617971549972566170109785691917629972",
"216717783021993818867789658453751978574",
"37233484920676268729337709465558123062",
"332503467205210778752042273814703319074",
"110091386492463754496108508179352421993",
"195221543859851252310558832569696974458",
"313708146565702258610500019920097341240",
"148211299058778067114695017640142481490",
"337992742111431779582092069722999294042",
"229904613379503752425140551968131935312",
"314376896684719248937890302584598132242",
"195541695323572531463519741140042079454",
"62676240847438916978718677163426205940",
"131467209450056515723500560498679424308",
"326681104628170182519659182460871250997",
"234886890903788278996535405848920748068",
"295452050653169010592386299474913603329",
"230135102557756592225448332397153352026",
"69031815842810034695737892657731653367",
"236218929924835133198618369295734616308",
"179453704966134054362260398767157216589",
"132251115848091341936382334023478077488",
"191837295881187089986992037011858313470",
"70624865508949854483526020623820972507",
"101791635778337717903832350577928731788",
"2899089120093640328249489732751868682",
"89380427282882711354183496435899660590",
"94441976324320205019413652138843906404",
"47906825985541379527831727782492897203",
"168788439829007677000374742387377227342",
"89780040109577452548858644994662168173",
"244891821148708484509552597381432475576",
"44739139782848831293482480058494914287",
"339043377986478189257689619395059942322",
"168592933071727607396213373237811208666",
"67101498494223483821378085730111586102",
"126577828734647740259722894969033161101",
"277212631171125185600630758542957883344",
"280924047046557878479736376788756006945",
"330036025471371411431285291409977274223",
"68276458041344084883062999692331781124",
"211249257302679035243428167027908841737",
"173289477475688172633532275174437720827",
"27604062829728601995110600799892192347",
"318966381013963479972046290338824959578",
"45905158703076835821155097910835939883",
"199575750134862074814867361253979128008",
"257192955994448772272720933812648303647",
"72354625323238762643374386765417335523",
"89951399636153271840115743412503265632",
"230684146183848556637113160610055349871",
"35564542183876419353166514938574097539",
"75407180318704451699303769443305508093",
"82492669128795064022106410097784768352",
"309606207319415080742135757994729221718",
"206918212154516456091987498471380655808",
"199459160482610027770876388918172121697",
"226318765970628466983039404091495311276",
"337198941700410024123484789557942224484",
"215980018141197532225823058179319508966",
"326265773554585183861935897085821889792",
"153016311601951300163194025966712416348",
"41223495171425725935768598574030836236",
"73055855404982602899009644939483123911",
"163760253656994444627371509946523626745",
"326270767391998666243405565587410139027",
"21317067112051592000597913966275554256",
"21303371786340289907177199149339579017",
"141308341991969646721653105511211871544",
"132262255902660676784860628035833211854",
"293735721632118471102227424222709244977",
"221264892404686019464685055981909563111",
"167759133802468412508345170663431226633",
"71347009309543524355816792432221179239",
"211646842768553748453221982415854906769",
"276001425944214196365438431424341285819",
"338147656409631818352586151739214891137",
"139501971923782827912143745739544394496",
"240171181337349374938990791252547871683",
"242930214086228328340722088946664435915",
"222107848685985131822420968400409755515",
"255328590063357841548329944227279674082",
"170693431140236290391811455509457615590",
"245732717629199971414628650016255457072",
"276467132395211738253667612045270985305",
"85124173254011616343682277197062335705",
"44681918832048174637271171294097797337",
"69968641243102480559258664819451322066",
"90667481138473626587233160946266639843",
"39566122999683459511693906427339319333",
"210276426144199593022758294752956421328",
"259302997351518479913851084929512926072",
"202306238703002936646733319215259740941",
"139087214149032422592324188453540973566",
"40002044136940729707559874925196572573",
"217217837165091857575541532206139662744",
"12821313245206029546059968922169585456",
"44658668401680493299680162382123417292",
"175607596901502442056537374123447728862",
"97181439557430282520529664894348269765",
"233315828623965065036633752229781993288",
"261099815035900052209875950704887419095",
"270632694493350101716151865227550533329",
"203497697238462247273254713076229473745",
"9343493068014598960721107703773931128",
"242673109635391476084032728898276412835",
"18453380910163286198796130559632562435",
"104888557086166439678103512294016953627",
"243688004514957275658509081710427018459",
"168723782744620544193929341216401031",
"59290559106496669692371089690767723133",
"292802539465384882407807210886461318624",
"244509731758780223817017543870043689804",
"323317634518113687318935871134007697479",
"114125956606386089272678878162930540369",
"111764345639786173480476303994901028577",
"121801479907906847487770970108608413647",
"132188957617397172780873823787617111259",
"293793906009143494038797256037103140805",
"169184990437227263978955076785177916518",
"94225940410244212654394837812933149569",
"2413510635908234320874912433937532345",
"51823902924222067872913661736555908556",
"74201910514270109037751204142018922238",
"218447670243756189704042677206333849342",
"185430168333881932020418791347129837157",
"12676059919280136951297873410834770070",
"118866395794606183282639351836489315320",
"95024357374552156682283951689913275821",
"306842509565170693962536541824150445109",
"303721449731154084663545825922948318176",
"269059617568928484200214866159204285732",
"133551376984235634007323458932038738050",
"277757868479419017971588481729327477764",
"274337210679566480177013780423241224175",
"73655726370855520026813867600863207428",
"2963096946539824611768680187661528514",
"256592267437931151947706343005662993181",
"333155539819150157011758439108980012502",
"257276458968230283278613371668046977926",
"123804571434507087119104105204184351833",
"213886601929572151805119867943290062035",
"306670943761999211228393447656349343302",
"179366580121051128105058221258737089772",
"18991959755423307049873603128261153564",
"4729676050886747518381600536902444480",
"313379439549369443501585656237313040722",
"288800748840345940972284546205910281235",
"53116335705619146372032629245109059017",
"210022783070824762531757304827496582718",
"76438488584974241649150933072923046510",
"281241755285514922764693615934105848807",
"249094017505389788375967665083751902957",
"176778355680320019337700317732774449198",
"241878692258798361552492931547545481131",
"18878265566416967482422046676406654178",
"43704644958743538843103064386883576065",
"39566122999683459511693906427339319333",
"210276426144199593022758294752956421328",
"259302997351518479913851084929512926072",
"292479637473478100743903930361628331889",
"94838258634036952379285723974370152870",
"267540841389413277068490151213246380057",
"33920302981111317555319466101594661181",
"44658668401680493299680162382123417292",
"64127843609340301116692262054851468722",
"156077718382899318980415647170797348139",
"216236465366747338915625698749096860011",
"286734961038078602128023807645274738581",
"119901165339083736935350994055712591152",
"193260016832149281907561658429772166830",
"336152897550384443634703568130827826801",
"310286142565705374113138475950351317167",
"21297331385581450595302025229787340259",
"21263092574053071887199851976085890980",
"3642735647138255756149453729786444793",
"289726625231100758520085302340290035431",
"79212690355945162840747813231638670898",
"336478182039081948936791277578454701683",
"32511478099051881603292100463527563559",
"298109219573885584191639612000203469731",
"286285052313678222957291883417817496121"
]
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-e65e8a3a",
"digest": {
"length": 1730,
"function_hash": "129489424189411872175341228802884761629"
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/MoQSession.cpp",
"function": "MoQSession::handlePreSetupUniStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-84894-ef6020c5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259897773993977273356000530114569935244",
"220277384392401909691602838447329553619",
"2117983858845533566317022479214818859",
"322467583376825171888034168187623842664",
"12068382094400281546248437567380344842",
"16163085583497993706418006428449066214"
]
},
"source": "https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94",
"target": {
"file": "moxygen/test/MoQSessionTests.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T17:56:27Z"
}
}
],
"modified": "2026-10-20T17:56:27.253610121Z",
"provider": "osv",
"references": [
"https://www.facebook.com/security/advisories/cve-2026-84894",
"https://github.com/facebookexperimental/moxygen/commit/004123dd24c30dad6b649163575145f240dabc94"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-84894",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 390126,
"published_at": "2026-09-28T19:16:50.213+00:00"
}