Vapor is a modestly represented Swift-based web framework and ecosystem whose vulnerability footprint centers on input handling and output encoding across its core framework and related components like Leafkit templating and PostgresNIO database drivers. The recurring weakness classes—including cross-site scripting, integer overflow, buffer overflows, and special-element injection—reflect the parser and string-handling demands of a web application stack that bridges template rendering, protocol marshaling, and database interaction. Defenders tracking this vendor should focus on framework updates and pay particular attention to template-layer and database-driver remediation; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vapor over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-32742CRITICAL Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing | Jul 9, 2021 | 9.1 | 26 | NO | NO |
CVE-2026-28499MEDIUM LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) | Mar 18, 2026 | 6.1 | 23 | NO | NO |
CVE-2026-27120MEDIUM Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters matc | Feb 20, 2026 | 6.1 | 21 | NO | NO |
CVE-2024-21631MEDIUM Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause | Jan 3, 2024 | 6.5 | 20 | NO | NO |
CVE-2023-31136MEDIUM PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker i | May 9, 2023 | 5.9 | 20 | NO | NO |
CVE-2022-31005HIGH Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the | May 31, 2022 | 7.5 | 20 | NO | NO |
CVE-2021-37634MEDIUM Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised | Aug 9, 2021 | 6.1 | 20 | NO | NO |
CVE-2022-31019HIGH Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following reques | Jun 9, 2022 | 7.5 | 19 | NO | NO |
CVE-2021-21328MEDIUM Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the | Feb 26, 2021 | 5.3 | 19 | NO | NO |
CVE-2023-44386MEDIUM Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections w | Oct 5, 2023 | 5.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vapor.
Media articles that mention a CVE ID that affects a product developed by Vapor — matched by CVE ID, not by vendor name.