SwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)

SwiftNIO 2.101.0 closes CVE-2026-43678, a remote denial-of-service flaw that let an unauthenticated peer crash any NIOWebSocket-based server with one short frame after the handshake completed.

The WebSocket frame decoder turned the eight-byte extended payload length into a Swift Int using a trapping conversion. Any 64-bit value with the high bit set therefore aborted the process with a fatal runtime trap. That conversion ran before the configured maximum frame size was checked, so no limit could stop it. The attack needs only an 11-byte frame and drops every active connection until the process is restarted. Servers built on Vapor and Hummingbird were among those exposed.

Versions through 2.100.0 are affected. The fix shipped in 2.101.0 on 8 June 2026; operators who have already upgraded need take no further action. Anyone still on an older release should move to 2.101.0 as soon as practical. The issue was reported by g0w6y, liyander, and brodmart.