fasthttp @ v1.76.0

integrity

size: 509.0 KiB
downloaded: 2026-10-19 10:02 UTC
last checked: 2026-10-19 10:02 UTC
overlays: go
detected: go module github.com/valyala/fasthttp

source https://github.com/valyala/fasthttp · available · github

release notes

v1.76.0 strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to TCPDialer.

Security fixes and hardening

Multipart parsing consumes the entire declared body. Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. #2336
Outgoing messages preserve framing. Raw Content-Length headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. FS and SendFile also stop at the advertised Content-Length when a file grows during serving. #2470, #2462
Requests with both Content-Length and Transfer-Encoding close the connection. The connection is no longer reused after a request containing both framing headers. #2476
Virtual-host file serving preserves directory isolation. NewVHostPathRewriter avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under FS.Root. This affects FS handlers using NewVHostPathRewriter. #2487
Rejected TLS connections no longer block the accept loop. Connections rejected by MaxConnsPerIP or Concurrency are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a ClientHello. IPv6 clients are now also counted against MaxConnsPerIP. #2486, #2468

Performance improvements

Trailer parsing avoids quadratic work. Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted Trailer headers and chunked trailer sections while preserving trailer order. #2465

HTTP compatibility and features

Static files handle range and conditional requests more accurately. Unsupported range units and multiple ranges are ignored instead of returning 416; invalid single byte ranges still return 416. Range is also ignored when If-Range does not match, and both Range and If-Modified-Since are ignored for methods other than GET and HEAD. #2467, #2473, #2474, #2475
Pipeline clients handle HEAD responses without reading a body. PipelineClient skips the response body for HEAD requests. #2469
HTTP parsing accepts valid legacy formats and matches tokens correctly. ParseHTTPDate accepts obsolete HTTP-date formats, cookies with an invalid Expires attribute remain parseable, Expect: 100-continue is matched case-insensitively, and Accept-Encoding matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. #2466, #2481, #2482, #2479, #2463
TCP keep-alives are configurable. The new TCPDialer.KeepAlive field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. #2484

What's Changed

Security and hardening

consume the rest of the declared body in readMultipartForm by @alhudz in https://github.com/valyala/fasthttp/pull/2336
fix: validate outgoing request framing by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2470
stop FS and SendFile at Content-Length when the file has grown by @alhudz in https://github.com/valyala/fasthttp/pull/2462
fix: close the connection after a request with both Content-Length and Transfer-Encoding by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2476
fix(fs): preserve vhost isolation during path rewriting by @koyokr in https://github.com/valyala/fasthttp/pull/2487
Fix TLS connection rejection blocking the accept loop by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2486
count IPv6 clients against MaxConnsPerIP by @alhudz in https://github.com/valyala/fasthttp/pull/2468

Performance

make addTrailerKey linear in the size of the trailer set by @alhudz in https://github.com/valyala/fasthttp/pull/2465

Features

feat: add KeepAlive option to TCPDialer by @littfed in https://github.com/valyala/fasthttp/pull/2484

Fixes

fix(header): reject asterisk-form request-target for non-OPTIONS methods by @aadieng100 in https://github.com/valyala/fasthttp/pull/2463
fix: accept the obsolete HTTP-date formats in ParseHTTPDate by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2466
fix(fs): ignore Range headers FS can't serve instead of replying 416 by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2467
skip the response body for HEAD requests in PipelineClient by @alhudz in https://github.com/valyala/fasthttp/pull/2469
fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2474
fix(fs): ignore Range when the If-Range validator doesn't match by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2473
fix(fs): ignore Range for methods other than GET and HEAD by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2475
fix(cookie): ignore an invalid Expires attribute instead of failing to parse by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2481
fix: match the Expect: 100-continue value case-insensitively by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2482
fix: match complete Accept-Encoding tokens by @jabrailkhalil in https://github.com/valyala/fasthttp/pull/2479

Documentation

docs: clarify RequestURI host behavior by @oozan in https://github.com/valyala/fasthttp/pull/2355

Dependency updates

chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2464
chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2483
chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2477
chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2478
chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2485

New Contributors

@aadieng100 made their first contribution in https://github.com/valyala/fasthttp/pull/2463
@LuisFigueroaG made their first contribution in https://github.com/valyala/fasthttp/pull/2466
@oozan made their first contribution in https://github.com/valyala/fasthttp/pull/2355
@jabrailkhalil made their first contribution in https://github.com/valyala/fasthttp/pull/2479
@koyokr made their first contribution in https://github.com/valyala/fasthttp/pull/2487

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0

download

unix · zip

curl -fL -o v1.76.0.zip https://ratatoskr.space/pkg/fasthttp/v1.76.0.zip
                    printf '%s  %s\n' 'e01c3741e9eb444743240bd0cd2acd8baa72822bb73a4d23264348c047dc869e' 'v1.76.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/fasthttp/v1.76.0.zip"
$out = "v1.76.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "e01c3741e9eb444743240bd0cd2acd8baa72822bb73a4d23264348c047dc869e") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.76.0.tar.gz https://ratatoskr.space/pkg/fasthttp/v1.76.0.tar.gz
                    printf '%s  %s\n' '7395409657aa187ba6954f9c6b99a2bbb9ebcee93a44e08f0d907f5e3a40b66d' 'v1.76.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/fasthttp/v1.76.0.tar.gz"
$out = "v1.76.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "7395409657aa187ba6954f9c6b99a2bbb9ebcee93a44e08f0d907f5e3a40b66d") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.76.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.zip
                    printf '%s  %s\n' 'e01c3741e9eb444743240bd0cd2acd8baa72822bb73a4d23264348c047dc869e' 'v1.76.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.zip"
$out = "v1.76.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "e01c3741e9eb444743240bd0cd2acd8baa72822bb73a4d23264348c047dc869e") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.76.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.tar.gz
                    printf '%s  %s\n' '7395409657aa187ba6954f9c6b99a2bbb9ebcee93a44e08f0d907f5e3a40b66d' 'v1.76.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.tar.gz"
$out = "v1.76.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "7395409657aa187ba6954f9c6b99a2bbb9ebcee93a44e08f0d907f5e3a40b66d") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.76.0.zip	zip	515.2 KiB	blake3-24 5a2a822b85050339502c13e33cde6bb98ca05e0eb5ea8d91 sha256 e01c3741e9eb444743240bd0cd2acd8baa72822bb73a4d23264348c047dc869e sha1 3d968007ee6a6bb0db213988a804d1dcdeef0dbf
v1.76.0.tar.gz	tar.gz	444.4 KiB	blake3-24 2ea0af0cd21c695ab18e027821250becd589937ecb27ea5e sha256 7395409657aa187ba6954f9c6b99a2bbb9ebcee93a44e08f0d907f5e3a40b66d sha1 082f9cb238d329c057995768cbb24adba8030c43

go module archive

module zip with the module path rewritten to this mirror; fetched by go get through the GOPROXY route

artifact	format	size	hashes
v1.76.0.zip	zip	519.4 KiB	blake3-24 26f85f3a6922a90d121cc664a1233ce33d2311b55d4b4da0 sha256 752c87252a701b3f5f41382dc72dd2738ce6e5b03a18251483e471eb3d503619 sha1 65e792da53552956a416ad696787682d5df477e6

install

bazel

http_archive(
    name = "fasthttp",
    urls = ["https://ratatoskr.space/pkg/fasthttp/v1.76.0.tar.gz"],
    integrity = "sha256-c5VAlleqGHumlU+ca5miu7nrzuk6ROCPDZB/XjpAtm0=",
    strip_prefix = "fasthttp-v1.76.0",
)

zig

.url = "https://ratatoskr.space/pkg/fasthttp/v1.76.0.tar.gz",

GOPROXY=https://ratatoskr.space GOSUMDB=off go get ratatoskr.space/pkg/fasthttp@v1.76.0

install via yggdrasil mesh

bazel

http_archive(
    name = "fasthttp",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.tar.gz"],
    integrity = "sha256-c5VAlleqGHumlU+ca5miu7nrzuk6ROCPDZB/XjpAtm0=",
    strip_prefix = "fasthttp-v1.76.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.76.0.tar.gz",

GOPROXY=http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg GOSUMDB=off GOINSECURE=14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/* go get 14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp@v1.76.0

v1.75.0 →