Facebook vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) faHigh 7.5 · Sep 28, 2026
• CVE-2026-84895 In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSessHigh 7.3 · Sep 28, 2026
• CVE-2026-44909 Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer.High 7.5 · Jul 23, 2026
• CVE-2025-30403 A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session.High 8.1 · Jul 11, 2025
• CVE-2024-45773 A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirablHigh 7.5 · Sep 27, 2024
• CVE-2023-49062 Katran could disclose non-initialized kernel memory as part of an IP header.High 7.5 · Nov 28, 2023
• CVE-2023-30470 A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65eCritical 9.8 · May 18, 2023
• CVE-2023-28753 netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function.Critical 9.8 · May 18, 2023
• CVE-2023-28081 A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary codCritical 9.8 · May 18, 2023
• CVE-2023-25933 A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary coCritical 9.8 · May 18, 2023
• CVE-2023-24833 A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw High 7.5 · May 18, 2023
• CVE-2023-24832 A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtimeHigh 7.5 · May 18, 2023
• CVE-2023-23759 There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely.High 7.5 · May 18, 2023
• CVE-2023-23557 An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to eCritical 9.8 · May 18, 2023
• CVE-2023-23556 An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execuCritical 9.8 · May 18, 2023
• CVE-2022-36937 HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension.Critical 9.8 · May 10, 2023
• CVE-2022-4899 A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.High 7.5 · Mar 31, 2023
• CVE-2022-36938 DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially alCritical 9.8 · Nov 10, 2022
• CVE-2022-40138 An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-BounCritical 9.8 · Oct 10, 2022
• CVE-2022-35289 A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially eCritical 9.8 · Oct 10, 2022
• CVE-2022-32234 An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute Critical 9.8 · Oct 10, 2022
• CVE-2022-27810 It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.High 7.5 · Oct 6, 2022
• CVE-2021-24044 By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator funCritical 9.8 · Jan 14, 2022
• CVE-2021-24042 The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp BusCritical 9.8 · Jan 4, 2022
• CVE-2021-24045 A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0.Critical 9.8 · Dec 13, 2021