Http3

v0.6.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 4mo Network Security

✓ No known CVEs patched

✓ No known CVEs patched in this version

Affected surfaces

auth rbac crypto_tls

Summary

AI summary

Added first-class raw QUIC client mTLS support with configurable server-side client‑certificate policies.

Full changelog

Added first-class raw QUIC client mTLS support through the public connectQuic() and connectQuicAsync() options, including cert/key validation and explicit ERR_HTTP3_TLS_CONFIG_ERROR failures for invalid TLS input.
Added raw QUIC server-side client certificate policy control with clientAuth: 'none' | 'request' | 'require', defaulting to require whenever a client-verification ca is configured.
Added peer-certificate inspection on QuicServerSession with peerCertificatePresented, getPeerCertificate(), and getPeerCertificateChain() so applications can pin exact client certificates after CA verification.
Updated the raw QUIC API contract, configuration reference, and QUIC guide with explicit mTLS examples, server policy semantics, and a documented certificate-pinning pattern.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Http3

Get notified when new releases ship.

About Http3