critical
GHSA-mgc4-wqv7-4pxm
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by GHSA.
Description
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics, CNIODarwin, CNIOHTTPParser and 29 more | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Show all 33 entries from 2 sources
| Source | Package | Fixed in |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIODarwin | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOHTTPParser | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOLinux | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOSHA1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOWindows | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOZlib | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | NIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIO | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOCore | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEmbedded | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOFoundationCompat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Client | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Server | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOMulticastChat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPerformanceTester | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPosix | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTLS | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTestUtils | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocket | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIOConcurrency | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIODataStructures | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
References
- https://github.com/apple/swift-nio
- https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
- https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
- https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
- https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
- https://github.com/apple/swift-nio/pull/1387
- https://github.com/apple/swift-nio/pull/1388
- https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm