github.com/valyala/fasthttp
v1.73.0
#110 most downloaded on Go modules
valyala/fasthttp
What this package is like to depend on
Last release 7 days ago
17 Aug 2026
Ships on a steady schedule
a new release about every 9 days
Rarely documented
notes for 10 of 78 stable releases
Nothing withdrawn
no release was ever pulled
11 years old
1977 releases · first in 2015
86 releases in the last 12 months
see the full history below
Release timeline
1977 releases · Mar 2016 to Aug 2026
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Releases
latest 60 of 1977-
v1.73.1-0.20260817064030-b8ff6fb0bb1c17 Aug 2026 pre-releaseNothing published for this version
-
v1.73.1-0.20260815082409-918acd2429e115 Aug 2026 pre-releaseNothing published for this version
-
v1.73.1-0.20260811122202-046bc31116d211 Aug 2026 pre-releaseNothing published for this version
-
v1.73.1-0.20260810072258-63901c3d629710 Aug 2026 pre-releaseNothing published for this version
-
v1.73.1-0.20260803072434-0bdb977009a503 Aug 2026 pre-releaseNothing published for this version
-
v1.73.1-0.20260801122836-ac1c005e948101 Aug 2026 pre-releaseNothing published for this version
-
v1.73.027 Jul 2026Release notes
Open source →What's Changed
- test: fix host comparison in FuzzURIParse by @ReneWerner87 in #2313
- perf: avoid redundant scans when parsing request headers by @ReneWerner87 in #2312
- Fix temp file leak in SaveMultipartFile on cross-device rename failure by @itxaiohanglover in #2311
- re-enable forcetypeassert by @Harshal96 in #2316
- test: normalize Go test names by @Harshal96 in #2317
- feat: prefix sentinel error strings by @Harshal96 in #2319
- fix(pprofhandler): use exact path matching to prevent debug data exposure by @xbrxr03 in #2302
- avoid following a symlink when writing the FS compressed cache by @alhudz in #2321
- refactor: improve internal interface names by @Harshal96 in #2318
- fix: lowercase error strings by @Harshal96 in #2320
- perf: reduce redundant scans and allocations in hot paths by @ReneWerner87 in #2322
- validate domain and path cookie attribute values on parse by @alhudz in #2315
- chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 by @dependabot[bot] in #2328
- chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2329
- fix: preserve pre-set status code in NewFastHTTPHandler by @xbrxr03 in #2323
- chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bot] in #2331
- reject backslash '..' traversal in fs handler on windows by @alhudz in #2327
- fix: reject Windows alternate data stream paths in FS by @dev-willbird1936 in #2335
- chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #2307
- chore(deps): bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by @dependabot[bot] in #2308
- chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by @dependabot[bot] in #2309
- chore(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by @dependabot[bot] in #2314
- chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #2326
- chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #2324
- chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #2325
New Contributors
- @itxaiohanglover made their first contribution in #2311
- @Harshal96 made their first contribution in #2316
- @dev-willbird1936 made their first contribution in #2335
Full Changelog: v1.72.0...v1.73.0
-
v1.72.1-0.20260727071846-d9babd95c5f327 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260725072235-e7cf856857a425 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260721052212-7a1349da706821 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260718081333-f1ad91d5197718 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260716055912-5f57d8fda4c216 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260711181632-7a012e987a3711 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260710123651-6d9bff6123f510 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260705123945-b7e7ecab911405 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260702070447-f932831cf26502 Jul 2026 pre-releaseNothing published for this version
-
v1.72.1-0.20260701151034-1906a3c3003001 Jul 2026 pre-releaseNothing published for this version
-
v1.72.027 Jun 2026Release notes
Open source →What's Changed
- Update to go1.25 as minimal version by @erikdubbelboer in #2205
- client: add aggregate connection count metrics by @z9z in #2201
- fix(server): return ErrMissingFile when MultipartForm.File is nil by @u5surf in #2260
- bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (#2218), #2247 by @erikdubbelboer in #2271
- bug: data race on pipeline client c.chR during worker drain (#2220) by @erikdubbelboer in #2272
- bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (#2222) by @erikdubbelboer in #2273
- bug: double concurrency counter increment in ServeConn causes counter leak (#2238) by @erikdubbelboer in #2275
- bug: body stream leak in compression methods when response is discarded (#2244) by @erikdubbelboer in #2276
- bug: InMemoryListener deadlock under high concurrency (#2245) by @erikdubbelboer in #2277
- bug: fasthttpadaptor writer leak, data race, and crash on handler panic (#2246) by @erikdubbelboer in #2278
- bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (#2248) by @erikdubbelboer in #2279
- bug: closeIdleConns TOCTOU race with serveConn idle timestamp (#2250) by @erikdubbelboer in #2280
- bug: AppendCert/AppendCertEmbed not thread-safe (#2251) by @erikdubbelboer in #2281
- bug: SetBodySizePoolLimit data race — plain int written without synchronization (#2252) by @erikdubbelboer in #2282
- bug: file descriptor leak in prefork parent process (#2253) by @erikdubbelboer in #2283
- security: SO_REUSEADDR on Windows enables port hijacking (#2254) by @erikdubbelboer in #2284
- bug: file descriptor leak on z/OS s390x when FcntlInt fails (#2255) by @erikdubbelboer in #2285
- bug: filesLockMap grows unboundedly, leaking memory (#2256) by @erikdubbelboer in #2286
- security: TLS verification silently disabled for malformed addresses (#2236) by @erikdubbelboer in #2274
- fix(fs): remove temporary file when compression fails by @u5surf in #2264
- fix double release of streamed client response body by @Mereng in #2211
- fix(client): switch to GET on 303 redirect per RFC 9110 by @u5surf in #2265
- ci: re-enable gocritic deferInLoop check for non-test code by @u5surf in #2288
- Fix flaky race tests by @erikdubbelboer in #2292
- fix(lbclient): prevent deadlock when all clients are removed by @u5surf in #2287
- reject duplicate Content-Length in response header parser by @alhudz in #2294
- strip cr/lf from header keys in normalizeHeaderKey by @alhudz in #2295
- fix(client): guard nil waiter in decConnsCount by @SAY-5 in #2266
- strip semicolons from cookie setters to block attribute injection by @alhudz in #2298
- feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of #2180 follow-up) by @ReneWerner87 in #2199
- fix: prevent data race on FSCompressedFileSuffixes map by @xbrxr03 in #2300
- reject duplicate Transfer-Encoding in request header parser by @alhudz in #2303
- preserve duplicate request headers in ConvertRequest by @alhudz in #2305
- fix(server): close listener on serve error in ListenAndServe helpers by @fereidani in #2304
- validate trailer values in parseTrailer by @alhudz in #2301
- Avoid default content type for empty requests by @nkgotcode in #2296
- chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2210
- chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2209
- chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by @dependabot[bot] in #2208
- chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #2207
- chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by @dependabot[bot] in #2261
- chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by @dependabot[bot] in #2267
- chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #2289
- chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #2290
- chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #2291
- chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2297
New Contributors
- @z9z made their first contribution in #2201
- @Mereng made their first contribution in #2211
- @alhudz made their first contribution in #2294
- @SAY-5 made their first contribution in #2266
- @xbrxr03 made their first contribution in #2300
- @fereidani made their first contribution in #2304
- @nkgotcode made their first contribution in #2296
Full Changelog: v1.71.0...v1.72.0
-
v1.71.1-0.20260627071648-37a31d78c5d227 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260622170207-9ee3c15997f822 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260621082643-2c1590038fa521 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260619102252-d37bae3b770519 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260615172403-ad93216ac16315 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260613072436-76aa66015c7f13 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260611115821-eb9bc61c6d1211 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260609093636-9df7942bcd0b09 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260608020017-cb4dc24ca0b508 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260602113529-46bfd1b9d8cb02 Jun 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260524024204-bf00c3e2dfbe24 May 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260517031405-6d7682aa72d117 May 2026 pre-releaseNothing published for this version
-
v1.71.1-0.20260516020808-c1e4fdd5b53f16 May 2026 pre-releaseNothing published for this version
-
v1.71.002 May 2026Release notes
Open source →What's Changed
- feat(client): add RetryIfErrUpstream function to handle upstream information by @mdenushev in #2176
- Match net/http sensitive header redirect policy by @erikdubbelboer in #2181
- Sanitize first-line header setters to prevent CRLF injection by @erikdubbelboer in #2182
- server: apply ReadTimeout before first byte with ReduceMemoryUsage by @erikdubbelboer in #2183
- header: reject invalid trailer names by @erikdubbelboer in #2188
- header: reject pre-colon whitespace in request headers by @erikdubbelboer in #2187
- Sanitize redirect Location header to prevent CRLF injection by @erikdubbelboer in #2186
- server: keep hijacked reader out of pool by @erikdubbelboer in #2184
- Sanitize cookie setters to prevent CRLF injection by @erikdubbelboer in #2185
- feat: add ExpectHandler for richer Expect: 100-continue handling by @miretskiy in #2175
- http: reject whitespace before chunk extensions by @erikdubbelboer in #2193
- header: reject unsupported response Transfer-Encoding by @erikdubbelboer in #2192
- header: match net/http CL+TE handling by @erikdubbelboer in #2190
- chore(deps): bump securego/gosec from 2.25.0 to 2.26.1 by @dependabot[bot] in #2195
- chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #2196
- feat(prefork): Enhance prefork management with WatchMaster, CommandProducer, and Windows support by @ReneWerner87 in #2180
New Contributors
- @miretskiy made their first contribution in #2175
Full Changelog: v1.70.0...v1.71.0
-
v1.70.1-0.20260502120935-e9208ecebf0c02 May 2026 pre-releaseNothing published for this version
-
v1.70.1-0.20260502051135-805cd104656702 May 2026 pre-releaseNothing published for this version
-
v1.70.1-0.20260425010203-1f00bc7c285725 Apr 2026 pre-releaseNothing published for this version
-
v1.70.1-0.20260425010141-6cd91f311b3225 Apr 2026 pre-releaseNothing published for this version
-
v1.70.1-0.20260420063848-c2e2a6c3e5c620 Apr 2026 pre-releaseNothing published for this version
-
v1.70.005 Apr 2026Release notes
Open source →What's Changed
- Go 1.26 and golangci-lint updates by @erikdubbelboer in #2146
- Add WithLimit methods for uncompression by @erikdubbelboer in #2147
- Honor Root for fs.FS and normalize fs-style roots by @erikdubbelboer in #2145
- Sanitize header values in all setter paths to prevent CRLF injection by @erikdubbelboer in #2162
- Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral by @erikdubbelboer in #2163
- Prevent chunk extension request smuggling by @erikdubbelboer in #2165
- Validate request URI format during header parsing to reject malformed requests by @erikdubbelboer in #2168
- HTTP1/1 requires exactly one Host header by @erikdubbelboer in #2164
- Strict HTTP version validation and simplified first line parsing by @erikdubbelboer in #2167
- Only normalize pre-colon whitespace for HTTP headers by @erikdubbelboer in #2172
- fs: reject '..' path segments in rewritten paths by @erikdubbelboer in #2173
- fasthttpproxy: reject CRLF in HTTP proxy CONNECT target by @erikdubbelboer in #2174
- fasthttpproxy: scope proxy auth cache to GetDialFunc by @erikdubbelboer in #2144
- feat: enhance performance by @ReneWerner87 in #2135
- export ErrConnectionClosed by @pjebs in #2152
- fix: detect master process death in prefork children by @meruiden in #2158
- return prev values by @pjebs in #2123
- docs: added httpgo to related projects by @MUlt1mate in #2169
- chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #2149
- chore(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 by @dependabot[bot] in #2170
- chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by @dependabot[bot] in #2129
- chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by @dependabot[bot] in #2140
- chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in #2166
- chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #2139
- chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @dependabot[bot] in #2128
- chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 by @dependabot[bot] in #2138
- chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @dependabot[bot] in #2125
- chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @dependabot[bot] in #2137
- chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 by @dependabot[bot] in #2142
- Update securego/gosec from 2.23.0 to 2.25.0 by @erikdubbelboer in #2161
New Contributors
- @MUlt1mate made their first contribution in #2169
- @meruiden made their first contribution in #2158
Full Changelog: v1.69.0...v1.70.0
-
v1.69.1-0.20260401075929-ab8c2aceea3d01 Apr 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260328060816-82254a7addc628 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260328021011-3c43293b0c8b28 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260326044645-95dcc31d244b26 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260323050701-389cba64723d23 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260316013536-4001e919114816 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260303234034-6fcfcb1ac0bc03 Mar 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260222171529-09d0cdbe0ea922 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260222171507-1d3c69196cee22 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260220215325-80e3281747cd20 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260215112721-a4ae8ef778ce15 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260212074543-407041cba6f612 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260208162602-887ef700b47608 Feb 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260130215542-3471acf23f1a30 Jan 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260119194129-5fbda86a8e0c19 Jan 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260113171136-a47d28f18f8c13 Jan 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260109181533-4df3fcd1feb609 Jan 2026 pre-releaseNothing published for this version
-
v1.69.1-0.20260107231311-21dbfe80cea907 Jan 2026 pre-releaseNothing published for this version
-
v1.69.005 Jan 2026Release notes
Open source →What's Changed
- Add sortkeys by @pjebs in #2118
- Expose header parsing error variables by @ReneWerner87 in #2096
- Add documentation that modifying during iteration can panic by @erikdubbelboer in #2122
- update readme by @pjebs in #2114
- chore(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #2092
- chore(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #2095
- chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by @dependabot[bot] in #2094
- chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 by @dependabot[bot] in #2098
- chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 by @dependabot[bot] in #2097
- chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in #2099
- chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #2101
- chore(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by @dependabot[bot] in #2103
- chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 by @dependabot[bot] in #2109
- chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #2111
- chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 by @dependabot[bot] in #2110
Full Changelog: v1.68.0...v1.69.0
-
v1.68.1-0.20251226001603-42f89fbefde626 Dec 2025 pre-releaseNothing published for this version
-
v1.68.1-0.20251218153433-fb6b6d160c1f18 Dec 2025 pre-releaseNothing published for this version
-
v1.68.1-0.20251215152435-fe7e70d901b815 Dec 2025 pre-releaseNothing published for this version