fasthttp @ v1.77.0

integrity

size: 549.4 KiB
downloaded: 2026-10-26 10:02 UTC
last checked: 2026-10-26 10:02 UTC
overlays: go
detected: go module github.com/valyala/fasthttp

source https://github.com/valyala/fasthttp · available · github

release notes

v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

Security fixes and hardening

Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

Features and resource management

An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

HTTP compatibility and connection handling

Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

What's Changed

Security and hardening

fix(fs): resolve default FS paths with os.Root so they stay inside Root by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2490
fix(fs): don't remove stale compressed files of a custom FS.FS from disk by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2489
fix: detach kept hijacked connections from the request context's reader by @h2zi in https://github.com/valyala/fasthttp/pull/2495

Features

Add an opt-in bounded stream reader by @CSXizhang in https://github.com/valyala/fasthttp/pull/2488
Export KeepBodyBuffer on Request and Response by @AdamMagued in https://github.com/valyala/fasthttp/pull/2451
fasthttpadaptor: add support for ResponseController SetReadDeadline and SetWriteDeadline by @AdamMagued in https://github.com/valyala/fasthttp/pull/2452

Fixes

fix: accept Accept-Encoding codings that carry a quality value by @ybai08 in https://github.com/valyala/fasthttp/pull/2491
fix: ignore Expect: 100-continue in HTTP/1.0 requests by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2492
fix: don't send 103 Early Hints to HTTP/1.0 clients by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2496
fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn by @h2zi in https://github.com/valyala/fasthttp/pull/2494
make PipeConns deadlines interrupt pending reads and writes by @h2zi in https://github.com/valyala/fasthttp/pull/2471
fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2497
fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2499
fix(cookie): recognize Secure, HttpOnly and Partitioned with a value by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2498
fix(cookie): trim tabs around cookie names, values and attributes by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2500
fix(cookie): store Set-Cookie without '=' under the key ParseBytes gives it by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2501
fix(fs): send Content-Range with 416 responses by @wleeaf in https://github.com/valyala/fasthttp/pull/2502

New Contributors

@ybai08 made their first contribution in https://github.com/valyala/fasthttp/pull/2491
@Thanatos9404 made their first contribution in https://github.com/valyala/fasthttp/pull/2489
@AdamMagued made their first contribution in https://github.com/valyala/fasthttp/pull/2452
@nk-batman21 made their first contribution in https://github.com/valyala/fasthttp/pull/2497
@wleeaf made their first contribution in https://github.com/valyala/fasthttp/pull/2502

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.76.0...v1.77.0

download

unix · zip

curl -fL -o v1.77.0.zip https://ratatoskr.space/pkg/fasthttp/v1.77.0.zip
                    printf '%s  %s\n' 'ef5927ea7f92785a6e655880eb6462c590806931ac566c990eb6b2f414911545' 'v1.77.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/fasthttp/v1.77.0.zip"
$out = "v1.77.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "ef5927ea7f92785a6e655880eb6462c590806931ac566c990eb6b2f414911545") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.77.0.tar.gz https://ratatoskr.space/pkg/fasthttp/v1.77.0.tar.gz
                    printf '%s  %s\n' '94bf0415c0f6f6178e04e5ce4d6ee8b4f75559a0a37a6c1047680e5255c9c173' 'v1.77.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/fasthttp/v1.77.0.tar.gz"
$out = "v1.77.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "94bf0415c0f6f6178e04e5ce4d6ee8b4f75559a0a37a6c1047680e5255c9c173") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.77.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.zip
                    printf '%s  %s\n' 'ef5927ea7f92785a6e655880eb6462c590806931ac566c990eb6b2f414911545' 'v1.77.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.zip"
$out = "v1.77.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "ef5927ea7f92785a6e655880eb6462c590806931ac566c990eb6b2f414911545") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.77.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.tar.gz
                    printf '%s  %s\n' '94bf0415c0f6f6178e04e5ce4d6ee8b4f75559a0a37a6c1047680e5255c9c173' 'v1.77.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.tar.gz"
$out = "v1.77.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "94bf0415c0f6f6178e04e5ce4d6ee8b4f75559a0a37a6c1047680e5255c9c173") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.77.0.zip	zip	556.1 KiB	blake3-24 b8dcec755e4a95af8ac5c93ac04e8399c94ebe2d366fcdba sha256 ef5927ea7f92785a6e655880eb6462c590806931ac566c990eb6b2f414911545 sha1 3e70bf7880cc7614561213aea945678d6cf370fd
v1.77.0.tar.gz	tar.gz	481.7 KiB	blake3-24 c4586a1aff5d85fe9dafdf13969f56b9b766d0e2ab221204 sha256 94bf0415c0f6f6178e04e5ce4d6ee8b4f75559a0a37a6c1047680e5255c9c173 sha1 19d6626be74d9c4714cf167e68b553896d4f90bb

go module archive

module zip with the module path rewritten to this mirror; fetched by go get through the GOPROXY route

artifact	format	size	hashes
v1.77.0.zip	zip	560.4 KiB	blake3-24 b86d4a3ea867fa3b1c03a6c237f15d1dd0a379232e80835e sha256 326fcd57ad22b406f4f0f9e9913b66b6ad7ecea96f4c8e9adf406c9f8c1e298b sha1 6d3c87162b982788fba140caf4e4087c9038c0e5

install

bazel

http_archive(
    name = "fasthttp",
    urls = ["https://ratatoskr.space/pkg/fasthttp/v1.77.0.tar.gz"],
    integrity = "sha256-lL8EFcD29heOBOXOTW7otPdVWaCjemwQR2gOUlXJwXM=",
    strip_prefix = "fasthttp-v1.77.0",
)

zig

.url = "https://ratatoskr.space/pkg/fasthttp/v1.77.0.tar.gz",

GOPROXY=https://ratatoskr.space GOSUMDB=off go get ratatoskr.space/pkg/fasthttp@v1.77.0

install via yggdrasil mesh

bazel

http_archive(
    name = "fasthttp",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.tar.gz"],
    integrity = "sha256-lL8EFcD29heOBOXOTW7otPdVWaCjemwQR2gOUlXJwXM=",
    strip_prefix = "fasthttp-v1.77.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp/v1.77.0.tar.gz",

GOPROXY=http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg GOSUMDB=off GOINSECURE=14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/* go get 14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/fasthttp@v1.77.0

v1.76.0 →