Executive brief
Swift-NIO is an open-source networking library used to build WebSocket servers in frameworks like Vapor and Hummingbird. An unauthenticated attacker can send a specially crafted 11-byte WebSocket frame that crashes the entire server process, disconnecting all active users until the service is manually restarted. This denies service to legitimate users without requiring any authentication or complex attack techniques.
Technical details
The vulnerability exists in WebSocketFrameDecoder's handling of the 8-byte extended payload length field defined in RFC 6455 §5.2. The decoder used Swift's trapping Int(_:) initializer to convert this field, which triggers a fatal runtime trap when the value has the most-significant bit set (≥0x8000_0000_0000_0000). This integer overflow trap fires before maxFrameSize validation and cannot be caught by the ByteToMessageDecoder, leaving all NIOWebSocket-based servers vulnerable. An attacker can trigger this with a single network-reachable request containing a malicious 11-byte frame after completing a WebSocket handshake, no authentication required. The fix (swift-nio 2.101.0) replaces the trapping initializer with Int(exactly:) and properly throws NIOWebSocketError.invalidFrameLength for out-of-range values.
Affected products
- Apple swift-nio <=2.100.0
- Vapor Vapor
- Hummingbird Hummingbird
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Fixed in swift-nio 2.101.0
- 2026-08-20: advisory