SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/apple/swift-nio (SwiftURL) | 1.0.0 to before 1.14.2 | 1.14.2 | Patch available | GHSA-mgc4-wqv7-4pxm |
| — | github.com/apple/swift-nio (SwiftURL) | 2.0.0 to before 2.13.1 | 2.13.1 | Patch available | GHSA-mgc4-wqv7-4pxm |
- github.com/apple/swift-nio (SwiftURL) Vendor— Affected 1.0.0 to before 1.14.2 Fixed in 1.14.2 Patch available GHSA-mgc4-wqv7-4pxm
- github.com/apple/swift-nio (SwiftURL) Vendor— Affected 2.0.0 to before 2.13.1 Fixed in 2.13.1 Patch available GHSA-mgc4-wqv7-4pxm
Remediation
- Fix · GHSA-mgc4-wqv7-4pxm github.com/apple/swift-nio (SwiftURL) Fixed in 1.14.2 Advisory →
- Fix · GHSA-mgc4-wqv7-4pxm github.com/apple/swift-nio (SwiftURL) Fixed in 2.13.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-mgc4-wqv7-4pxm
References
Other 8
- https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm
- https://github.com/apple/swift-nio/pull/1387
- https://github.com/apple/swift-nio/pull/1388
- https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
- https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
- https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
- https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
- https://github.com/apple/swift-nio
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences