Skip to content

Static Web Server

v2.43.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Reverse Proxies & Load Balancers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

alpine-linux amd64 android arm arm64 darwin
+14 more
debian-linux docker file-server freebsd http-server http2 linux macos musl-libc rust-lang static-web-server tls windows x86

Affected surfaces

crypto_tls

Summary

AI summary

Updates CI, follow-up, and Docker across a mixed release.

Changes in this release

Feature Medium

Adds FIPS‑capable TLS via new `http2-fips` Cargo feature using `aws-lc-rs`.

Adds FIPS‑capable TLS via new `http2-fips` Cargo feature using `aws-lc-rs`.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds optional default text charset via `--default-charset` flag.

Adds optional default text charset via `--default-charset` flag.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Updates project dependencies to latest versions.

Updates project dependencies to latest versions.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Updates Docker Alpine base image to 3.23.4.

Updates Docker Alpine base image to 3.23.4.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Dependency Low

Updates Docker Debian base image to 13.5.

Updates Docker Debian base image to 13.5.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Performance Medium

Improves directory listing performance.

Improves directory listing performance.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Performance Medium

Applies general performance optimizations across several modules.

Applies general performance optimizations across several modules.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Performance Low

Enhances byte‑range suffix detection and extract normalization coverage.

Enhances byte‑range suffix detection and extract normalization coverage.

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

 —
Bugfix Medium

Fixes unnecessary pre-compressed file lookup when uncompressed file is missing.

Fixes unnecessary pre-compressed file lookup when uncompressed file is missing.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Refactor Low

Increases hardening and robustness of several modules.

Increases hardening and robustness of several modules.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Refactor Low

Sets minimum size threshold for dynamic compression.

Sets minimum size threshold for dynamic compression.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Full changelog

This new v2.43.0 brings bug fixes, new features and improvements. A fix for unnecessary pre-compressed file lookups, FIPS-capable TLS support via a new Cargo feature and prebuilt binaries, several performance optimizations, hardening across several modules, better byte-range suffix detection and extract normalization coverage, CI workflow updates and other enhancements.

Fixes

  • b224b6e Update project dependencies. PR #685 by @joseluisq
  • 8421a06 Unnecessary pre-compressed file look up when the uncompressed one doesn't exist. PR #684 by @joseluisq
  • 9b9c1a7 Docker: Update Alpine (3.23.4) & Debian (13.5) Docker images. PR #678 by @joseluisq

Features

  • 3ff096c FIPS-capable TLS via new http2-fips Cargo feature flag using aws-lc-rs in FIPS mode. PR #645 by @alexander-bauer. See docs, new Docker Images and prebuilt binaries available.
  • 7ff6cf6 Optional default text charset via --default-charset. PR #656 by @davlgd. See docs (follow-up PR #657 by @joseluisq).

Refactorings

  • a5af389 Hardening and robustness increase for several modules. PR #672 by @joseluisq
  • 6514b87 Minimum size threshold for dynamic compression. PR #673 by @joseluisq
  • f503ee1 Byte-range suffix detection and extract normalization helpers, which increases case coverage. PR #674 by @joseluisq
  • e5103c3 Performance optimizations for several modules. PR #675 by @joseluisq
  • aa66137 Improve directory listing performance. PR #676 by @joseluisq
  • 2302e46 Improve MIME types for compression and default text charset features (follow-up). PR #657 by @joseluisq
  • 216e45b CI: Update devel workflow to compile several targets and FIPS directly via GitHub Actions runners. PR #691 by @joseluisq
  • 2ac6c5e CI: Update release workflow to compile several targets and FIPS directly via GitHub Actions runners. PR #693 by @joseluisq
  • dc2c7a2 CI: Update release GitHub Actions workflows for FIPS builds (follow-up). PR #689 by @joseluisq
  • 6f0d607 CI: Update release GitHub Actions workflows for FIPS builds. PR #688 by @joseluisq

Docs

  • f93f80e Add missing FIPS Docker images and binary descriptions. PR #687 by @joseluisq
  • 6dc9798 Add missing .html suffix feature for 404 errors. PR #686 by @joseluisq

For more details see the v2.43.0 milestone and the full changelog v2.42.0...v2.43.0.

Security Fixes

  • Hardening across several modules — unspecified security improvements
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Static Web Server

Get notified when new releases ship.

Sign up free

About Static Web Server

Cross-platform, high-performance, and asynchronous web server for static file serving.

All releases →

Related context

Beta — feedback welcome: [email protected]