Quick answers
- Is CVE-2026-43678 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43678 being exploited in the wild.
- How severe is CVE-2026-43678?
- Medium severity, with a CVSS score of 5.3, published 20 August 2026.
- Which products and versions are affected?
- Apple Swift-Nio <=2.100.0.
- Is there a fix for CVE-2026-43678?
- A patch was published on 2026-07-09: Fixed in swift-nio 2.101.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-43678 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-43678?
- Check whether you run Apple Swift-Nio, Apple SwiftNIO, Hummingbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in WebSocketFrameDecoder's handling of the 8-byte extended payload length field defined in RFC 6455 §5.2. The decoder used Swift's trapping Int(_:) initializer to convert this field, which triggers a fatal runtime trap when the value has the most-significant bit set (≥0x8000_0000_0000_0000). This integer overflow trap fires before maxFrameSize validation and cannot be caught by the ByteToMessageDecoder, leaving all NIOWebSocket-based servers vulnerable. An attacker can trigger this with a single network-reachable request containing a malicious 11-byte frame after completing a WebSocket handshake, no authentication required. The fix (swift-nio 2.101.0) replaces the trapping initializer with Int(exactly:) and properly throws NIOWebSocketError.invalidFrameLength for out-of-range values.
Affected products
- Apple swift-nio <=2.100.0
- Vapor Vapor
- Hummingbird Hummingbird
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Fixed in swift-nio 2.101.0
- 2026-08-20: advisory