Skip to content

ferron

Reverse Proxies & Load Balancers

A fast, memory-safe web server written in Rust.

Track releases GitHub Website
Rust Latest 3.0.0-beta.5 · 21d ago Security brief →

Features

  • High‑performance web server optimized for speed and high concurrency
  • Memory‑safe implementation written in Rust
  • Automatic TLS via Let's Encrypt integration
  • Simple, intuitive configuration with secure defaults
  • Modular architecture enabling easy extensibility

Recent releases

View all 17 releases →
Config change
3.0.0-beta.5 Mixed
Auth RCE / SSRF

Symlink protection + TLS metrics + load balancing

Open
No immediate action
2.8.1 Bug fix

Routing bug fix

Open
Review required
2.8.0 Bug fix
Auth Breaking upgrade

Directory listing escaping

Open
3.0.0-beta.1 New feature
Notable features
  • CLI utility for hashing passwords
  • CLI utility for pre‑compressing static files
  • CLI utility for translating Ferron 2 configurations into Ferron 3 ones
Full changelog

Added

  • CLI utility for hashing passwords.
  • CLI utility for pre-compressing static files.
  • CLI utility for translating Ferron 2 configurations into Ferron 3 ones.
  • CLI utility for zero-configuration serving.

Changed

  • Non-existent webroots now lead to 404 Not Found errors instead of 500 Internal Server Error errors.

Fixed

  • Partial hostname resolution match in HTTP server could lead to incorrect routing.
  • Redirects configured with status directive didn't have some placeholder locations (such as $1) replaced when using a regex match.
  • Redirects configured with status directive didn't lead to any destination.
  • Reverse proxy was sometimes routed to wrong backend server.
  • Some default cache paths were unwritable in some cases.
  • Unknown directives in global blocks for status directive (even though they're known in host blocks) caused the web server to fail to start.
  • When using OTLP, access logs were emitted with "access_log" body, not actual access logs.
View release on GitHub
2.7.0 Security relevant
Security fixes
  • Path traversal when URL sanitizer disabled and path canonicalization failed
  • Proxy header leak in CGI/FastCGI/SCGI (httpoxy)
Notable features
  • DNSimple DNS provider support
  • IP-based TLS certificate support
  • JSON-format access logs
View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
2,092
Forks
90
Languages
Rust Shell PowerShell
View on GitHub Homepage Documentation

Install & Platforms

Install via
binary docker
Platforms
linux windows macos

Community & Support

Community

Similar tools

Static Web Server
caddy
zoraxy
microbin
bichon

Beta — feedback welcome: [email protected]