CVE-2026-119236 · Package
NO FIX YET · SEE WHAT TO DO
An mvfst QUIC server kept CRYPTO frame data sent at handshake levels the TLS handshake had already passed, and did not count it against the buffer limit. A remote, unauthenticated client can keep sending that data to grow server memory without bound, causing denial of service.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run a QUIC server built on mvfst and accept connections from untrusted clients. The sources do not say which products or default configurations embed mvfst, so teams should check their dependency tree for it.
Not affected if mvfst-not-in-use
Who cares mvfst, quic, self-hosted
v2026.11.09.00 or laterAn mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.