We have released nghttp2 v1.70.0.

Do not download the archive files generated by GitHub. They do not work. Please download the signed and versioned tar balls, such as nghttp2-1.70.0.tar.gz.

lib

This release fixes the CONTINUATION frame counts. Previously it may increase counter by multiple times for a single CONTINUATION frame.

It tightens up HTTP status code parser and requires 3 digits code.

third-party

mruby has been updated to v4.0.0.

llhttp has been updated to v9.4.2.

neverbleed has been updated to the latest commit.

src

Now the source code needs C++23 compilers.

nghttp

Put pseudo headers before normal headers specified in --header option.

nghttpx

The option, --frontend-min-write-rate, to specify the minimum frontend write rate has been added. If violated, the connection will be closed.

--stream-read-timeout option has been deprecated. Now the timeout can be specified for frontend and backend separately using --frontend-stream-read-timeout and --backend-stream-read-timeout.

--stream-write-timeout option has been deprecated. Now the timeout can be specified for frontend and backend separately using --frontend-stream-write-timeout and --backend-stream-write-timeout.

This release tightens up CONNECT and HTTP Upgrade handling to shut down the possibility of the request smuggling attack.