Skip to content

Http3

v0.7.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 3mo Network Security
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Summary

AI summary

Updates Performance, Test infrastructure, and Transport drivers across a mixed release.

Full changelog

Memory leak and correctness fixes

  • Fixed a heap leak where stream readable sides were never consumed on GET requests — heap dropped from 358MB to 5.4MB after 1M requests.
  • Fixed silent data loss at 8 call sites where fatal send errors were swallowed; now properly emits EVENT_ERROR to JS.
  • Fixed partial-write data loss in borrow-based stream_send.
  • Fixed io_uring RX buffer ring exhaustion with stop-and-wait cross-thread echo protocol.

Performance (+21.8% H3 sustained throughput)

  • RecyclableBuffer for inbound data — napi_create_external_buffer with finalize callbacks that return buffers to the worker pool via crossbeam, eliminating malloc fragmentation.
  • ChunkPool with 1KB/2KB/4KB size classes for outbound sends, with auto-recycle on drop.
  • Zero-copy H3 send via send_body_owned() wrapping Vec in ArcBuf without copying.
  • Event shape normalization — all JsH3Event objects now present the same set of JS properties, reducing V8 hidden classes from 6-8 to 2.
  • Lazy BackpressureState — per-stream state deferred until first backpressure, saving ~69K allocations/s.
  • Combined sendResponse — new respondWithBody() sends headers + body + FIN in 1 NAPI call instead of 3.

Shutdown lifecycle fix

  • Fixed a deadlock in close() on all four event loop types (H3 server/client, QUIC server/client) caused by synchronous thread join blocking the JS event loop.
  • Split shutdown() into requestShutdown() + joinWorker(), safe for all transport drivers (io_uring, kqueue, poll).

Transport drivers

  • io_uring: RX buffer ring exhaustion fix, waker resubmit, sendmsg EAGAIN handling.
  • kqueue: pending-write drain fixes, waker reliability.
  • Driver-tracing feature gate for optional per-event diagnostics.

Test infrastructure

  • 545 tests (161 Rust unit, 53 integration, 8 packet loss, 325 TypeScript).
  • 34 e2e scenarios (REST CRUD, file serving, SSE, streaming, concurrency, datagrams, server push).
  • 5-minute longhaul: H3 sustained at 24.6K req/s, QUIC at 45.6K streams/s (0 errors).
  • FFI boundary stress, packet loss simulation, heap profiling scripts.

Dependencies

Rust 1.94, napi-rs 3.8, quiche 0.26.1 (BoringSSL), pnpm.

Full changelog: https://github.com/currentspace/http3/blob/main/CHANGELOG.md#070

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Http3

Get notified when new releases ship.

Sign up free

About Http3

All releases →

Related context

Beta — feedback welcome: [email protected]