ExpressVPN reimplemented its open-source Lightway VPN protocol from C to Rust to better exploit multicore hardware while avoiding manual memory-management risks. The new workspace runs on Tokio's multithreaded async runtime, denies unsafe Rust by default, and keeps wolfSSL for cryptography behind carefully audited bindings. Two independent security audits (Cure53, Praetorian) found and resolved all issues, and the Rust version achieved up to 2x speed on Aircove routers and nearly 4x throughput on iOS versus the old C implementation, ahead of any platform-specific optimization. The Rust rewrite began rolling out to iOS users in May 2026 and remains AGPLv3-licensed.
Table of contents
About ExpressVPNThe Challenge: scaling a security-critical protocol across cores without the risks of manual memory managementWhat They Built: an open-source Rust workspace, with unsafe code denied by defaultThe Results: nearly 4x the throughput, independently auditedQuestions this post answers
Why did ExpressVPN rewrite its Lightway VPN protocol from C to Rust?
ExpressVPN moved Lightway to Rust to safely exploit multicore hardware without taking on the manual memory management risks of C, such as data races, buffer overflows, and use-after-free bugs. The rewrite runs on Tokio's multithreaded async runtime, denies unsafe Rust by default, and keeps wolfSSL for cryptography behind narrowly scoped, audited unsafe boundaries. Teams weighing a C-to-Rust rewrite for performance-critical networking code can track real-world case studies like this on daily.dev.
How much faster is ExpressVPN's Rust implementation of Lightway compared to the old C version?
The Rust implementation delivered nearly 4x the throughput on iOS compared to the previous C implementation, measured with a standard Rust release build before any architecture-specific CPU optimization. On Aircove routers, ExpressVPN's dedicated router hardware, it achieved up to 2x the speed. Rollout to iOS users began in May 2026. Developers evaluating Rust for performance-sensitive rewrites can follow benchmarks like this on daily.dev.
What security audits did ExpressVPN's Rust rewrite of Lightway undergo?
Two independent security firms audited the Rust rewrite: Cure53 found five issues including one exploitable denial-of-service vulnerability, and Praetorian found two low-risk findings. ExpressVPN resolved every finding and both firms validated the fixes through retesting; Cure53 confirmed Rust's memory-safety features were effectively leveraged, and Praetorian noted disciplined use of unsafe code. Security-focused engineers reviewing Rust migration audits can find similar reports on daily.dev.
3.4K Impressions1 Comment