The content length field is parsed without validation in readHttpRequest:

        if let contentLength = request.headers["content-length"], let contentLengthValue = Int(contentLength) {
            request.body = try readBody(socket, size: contentLengthValue)
        }

If content-length is set to -1, this results in the creation of an UnsafeMutableBufferPointer with a negative count downstream, a fatalError.