Facebook

Facebook's vulnerability footprint concentrates in a focused set of infrastructure and runtime products—most notably the HHVM virtual machine, Hermes JavaScript engine, Thrift middleware, and Proxygen HTTP library—that power internal and external service delivery at scale. Though the product portfolio remains relatively narrow, these components sit deep in production stacks and reach significant prominence in the vulnerability landscape, and vulnerabilities affecting them skew strongly toward critical-severity outcomes. The exposure recurs persistently through memory-safety and deserialization weakness classes: out-of-bounds reads and writes, use-after-free conditions, buffer-boundary violations, and untrusted deserialization, reflecting the low-level performance and parsing demands of runtime systems and middleware. Defenders tracking these products should prioritize patching for the severity risk they carry; current exploitation activity and exposure counts are shown alongside this summary.