We have released nghttp2 v1.17.0. The changes are summarized below.

libnghttp2

In this release, libnghttp2 by default disallows content-length header field in 1xx, 204, or 200 to a CONNECT request as described in RFC 7230.

libnghttp2_asio

Previously, server-side on_close callback was not called when connection was closed while streams were still alive. Now on_close callback is called for active streams on connection close.

build

Remo E provided a patch to include MSVC version resource in cmake Windows build.

nghttpx

We fixed the bug that sometimes made nghttpx crash if --backend-http-proxy-uri was used.

We fixed the bug that one HTTP header fields from HTTP/1.1 backend were split into multiple fields in some situations.

We fixed the bug that zero-length POST was not forwarded to HTTP/1.1 backend, causing dead lock.

We removed optional reason phrase from SPDY response header fields. This is OK since reason phrase is optional.

To align the changes made in libnghttp2 that disallows content-length in 1xx, 204, or 200 to a CONNECT request, we did the same thing to HTTP/1.1 backend. We also disallow transfer-encoding in those status codes as well.

dalf provided a patch to fix compile failure with BoringSSL.

nghttpd, nghttpx, and libnghttp2_asio

We fixed the bug that mandatory SP after status code wass missing in HTTP/1.1 status line.