CVE-2026-84894

Name of the Vulnerable Software and Affected Versions moxygen versions prior to commit 004123dd24c3

Description The MoQSession::dataStreamReadLoop() function continues to use a stream read handle after a FIN (a signal indicating the end of a data stream) has been read. This action invalidates the handle within the proxygen WebTransport API. A remote peer can trigger this stale handle usage by opening a data stream that specifies an unknown track alias and includes the FIN in the same write operation.

Recommendations Update moxygen to commit 004123dd24c3 or a later version.