SwiftNIO: one request with huge numbers of headers can take down a Vapor or Hummingbird server
Identifiers: CVE-2026-28980 · GHSA-rj37-6j9x-74q6 · CVSS 4.0 8.7 (scored by GitHub)
What it is
SwiftNIO's HTTP/1 parser put no limit on how many headers a request may carry or on their total size. Anyone can send a request with hundreds of thousands of small headers: Hummingbird 2 crashes, and Vapor 4 uses more and more memory until the server falls over. No login is needed.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| SwiftURL | github.com/apple/swift-nio | <= 2.99.0 | 2.100.0 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up github.com/apple/swift-nio in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade swift-nio to 2.100.0 or later (swift package update swift-nio, then commit Package.resolved). Until then, put a reverse proxy in front that caps the number and size of headers (nginx: large_client_header_buffers).
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.