HTTP/2 C library and tools

Nghttp2 v1.60.0

We have released nghttp2 v1.60.0.


RFC 7540 priorities (aka stream dependencies) APIs have been deprecated. They work just like before, but in the future release after the end of 2024, the functionality is removed, and the deprecated APIs start behaving differently. See the API documentation for details. RFC 7540 priorities have been deprecated by RFC 9113. Consider migrating RFC 9218 extensible prioritization scheme.

The APIs that use ssize_t, including structs and callback functions, have been deprecated. New APIs that use nghttp2_ssize are introduced as a replacement. The usage of ssize_t is problematic for several reasons. Some platforms do not define ssize_t. The minimum value of ssize_t that POSIX requires is -1 which makes nghttp2 error code out of range. nghttp2_ssize is an alias of ptrdiff_t that is in C standard and covers our error code range.

New code should use new nghttp2_ssize APIs. The existing applications should consider migrating to new APIs.

The deprecated ssize_t APIs continue to work for backward compatibility.

Here is the summary of the deprecated APIs and their replacements:

Callback functions:

  • nghttp2_data_source_read_callback => nghttp2_data_source_read_callback2
  • nghttp2_data_source_read_length_callback => nghttp2_data_source_read_length_callback2
  • nghttp2_pack_extension_callback => nghttp2_pack_extension_callback2
  • nghttp2_recv_callback => nghttp2_recv_callback2
  • nghttp2_select_padding_callback => nghttp2_select_padding_callback2
  • nghttp2_send_callback => nghttp2_send_callback2


  • nghttp2_data_provider => nghttp2_data_provider2


  • nghttp2_hd_deflate_hd => nghttp2_hd_deflate_hd2
  • nghttp2_hd_deflate_hd_vec => nghttp2_hd_deflate_hd_vec2
  • nghttp2_hd_inflate_hd2 => nghttp2_hd_inflate_hd3
  • nghttp2_pack_settings_payload => nghttp2_pack_settings_payload2
  • nghttp2_session_callbacks_set_data_source_read_length_callback => nghttp2_session_callbacks_set_data_source_read_length_callback2
  • nghttp2_session_callbacks_set_pack_extension_callback => nghttp2_session_callbacks_set_pack_extension_callback2
  • nghttp2_session_callbacks_set_recv_callback => nghttp2_session_callbacks_set_recv_callback2
  • nghttp2_session_callbacks_set_select_padding_callback => nghttp2_session_callbacks_set_select_padding_callback2
  • nghttp2_session_callbacks_set_send_callback => nghttp2_session_callbacks_set_send_callback2
  • nghttp2_session_mem_recv => nghttp2_session_mem_recv2
  • nghttp2_session_mem_send => nghttp2_session_mem_send2
  • nghttp2_submit_data => nghttp2_submit_data2
  • nghttp2_submit_request => nghttp2_submit_request2
  • nghttp2_submit_response => nghttp2_submit_response2

For those applications that do not want to see ssize_t in nghttp2.h header file at all, define NGHTTP2_NO_SSIZE_T macro before including nghttp2.h. It hides all ssize_t APIs.


cmake build and install trees are now fixed.

The following dependencies have been updated:

  • ngtcp2
  • nghttp3

CUnit has been replaced with ngtcp2/munit. munit is pulled via git submodule.

The flags to build applications with libbrotli have been added.


llhttp has been updated.

mruby is updated to v3.3.0.


--sni option has been added.


The certificate compression support with boringssl (or aws-lc) and libbrotli has been added.