CVE-2026-43678: Swift-nio/NIOWebSocket vulnerability

Q: Which deployments are exposed?

Any server using NIOWebSocket is affected, including Vapor and Hummingbird applications that use it for WebSocket connections.

Q: What must an attacker do to trigger the crash?

The attacker needs only network access to the WebSocket endpoint and must complete a WebSocket handshake before sending a single 11-byte frame. No authentication is required.

Q: What is the operational impact of exploitation?

The server process crashes, dropping all active connections. Service remains unavailable until the process restarts.

Q: Which version addresses the issue?

The vulnerability is addressed in swift-nio version 2.101.0.

Published Aug 20, 2026

Updated

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

Affected Software

1 affected component

swift-nio/NIOWebSocket<2.101.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade swift-nio to a version that resolves this vulnerability.
Fixed in 2.101.0

Event History

Aug 20, 2026

CVE Published

via MITRE·06:57 PM

Data Sourced

via MITRE·06:57 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Any server using NIOWebSocket is affected, including Vapor and Hummingbird applications that use it for WebSocket connections.

What must an attacker do to trigger the crash?

The attacker needs only network access to the WebSocket endpoint and must complete a WebSocket handshake before sending a single 11-byte frame. No authentication is required.

What is the operational impact of exploitation?