CVE-2026-119235 · Package
NO FIX YET · SEE WHAT TO DO
Facebook's proxygen HTTP/3 library buffers an oversized QPACK string literal sent on the encoder stream without enforcing its size limit until the whole literal arrives. An unauthenticated remote peer can keep a connection sending data and exhaust server memory, causing denial of service.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Services that run proxygen to accept HTTP/3 connections from the internet are exposed, because the decoder runs on the QPACK encoder stream regardless of dynamic table settings. Systems that do not serve HTTP/3 through proxygen can skip it.
Not affected if no-http3-listener, pinned-patched-version
Who cares c++, http3, proxygen
v2026.11.09.00.v2026.11.09.00 or later.proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.