This release adds 3 notable features for engineering teams evaluating rollout.
Published 3mo
Network Security
✓ No known CVEs patched
✓ No known CVEs patched in this version
Summary
AI summaryUpdates Performance, Test infrastructure, and Transport drivers across a mixed release.
Full changelog
Memory leak and correctness fixes
- Fixed a heap leak where stream readable sides were never consumed on GET requests — heap dropped from 358MB to 5.4MB after 1M requests.
- Fixed silent data loss at 8 call sites where fatal send errors were swallowed; now properly emits
EVENT_ERRORto JS. - Fixed partial-write data loss in borrow-based
stream_send. - Fixed io_uring RX buffer ring exhaustion with stop-and-wait cross-thread echo protocol.
Performance (+21.8% H3 sustained throughput)
- RecyclableBuffer for inbound data —
napi_create_external_bufferwith finalize callbacks that return buffers to the worker pool via crossbeam, eliminating malloc fragmentation. - ChunkPool with 1KB/2KB/4KB size classes for outbound sends, with auto-recycle on drop.
- Zero-copy H3 send via
send_body_owned()wrapping Vec in ArcBuf without copying. - Event shape normalization — all
JsH3Eventobjects now present the same set of JS properties, reducing V8 hidden classes from 6-8 to 2. - Lazy BackpressureState — per-stream state deferred until first backpressure, saving ~69K allocations/s.
- Combined
sendResponse— newrespondWithBody()sends headers + body + FIN in 1 NAPI call instead of 3.
Shutdown lifecycle fix
- Fixed a deadlock in
close()on all four event loop types (H3 server/client, QUIC server/client) caused by synchronous thread join blocking the JS event loop. - Split
shutdown()intorequestShutdown()+joinWorker(), safe for all transport drivers (io_uring, kqueue, poll).
Transport drivers
- io_uring: RX buffer ring exhaustion fix, waker resubmit, sendmsg EAGAIN handling.
- kqueue: pending-write drain fixes, waker reliability.
- Driver-tracing feature gate for optional per-event diagnostics.
Test infrastructure
- 545 tests (161 Rust unit, 53 integration, 8 packet loss, 325 TypeScript).
- 34 e2e scenarios (REST CRUD, file serving, SSE, streaming, concurrency, datagrams, server push).
- 5-minute longhaul: H3 sustained at 24.6K req/s, QUIC at 45.6K streams/s (0 errors).
- FFI boundary stress, packet loss simulation, heap profiling scripts.
Dependencies
Rust 1.94, napi-rs 3.8, quiche 0.26.1 (BoringSSL), pnpm.
Full changelog: https://github.com/currentspace/http3/blob/main/CHANGELOG.md#070
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Http3
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]