---
id: "CVE-2026-119236"
page: "https://infrastack.ai/live/CVE-2026-119236"
kind: "vulnerability"
aliases: ["CVE-2026-119236"]
title: "mvfst: QUIC server memory growth lets remote clients cause denial of service"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mvfst", "package", "quic", "self-hosted"]
not_affected_if: ["mvfst-not-in-use"]
published_at: "2026-11-11T17:17:16+00:00"
first_seen_at: "2026-11-11T17:28:21+00:00"
updated_at: "2026-11-11T17:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119236", "first_seen_at": "2026-11-11T17:28:21+00:00"}]
exploit_sources: []
---

# mvfst: QUIC server memory growth lets remote clients cause denial of service

Link for people: https://infrastack.ai/live/CVE-2026-119236 (this .md is for agents)

An mvfst QUIC server kept CRYPTO frame data sent at handshake levels the TLS handshake had already passed, and did not count it against the buffer limit. A remote, unauthenticated client can keep sending that data to grow server memory without bound, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the mvfst version in your dependency tree, for example by inspecting the lockfile or build manifest.
- Confirm whether the QUIC server is reachable from the internet or from untrusted networks.

## Fix

- mvfst: upgrade to `v2026.11.09.00` or later

## Timeline

- 2026-11-11T17:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119236

## Documents

- [fix] Patch: github.com https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44

## From the sources

An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_