v1.76.0 strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to TCPDialer.

Security fixes and hardening

• Multipart parsing consumes the entire declared body. Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. #2336
• Outgoing messages preserve framing. Raw Content-Length headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. FS and SendFile also stop at the advertised Content-Length when a file grows during serving. #2470, #2462
• Requests with both Content-Length and Transfer-Encoding close the connection. The connection is no longer reused after a request containing both framing headers. #2476
• Virtual-host file serving preserves directory isolation. NewVHostPathRewriter avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under FS.Root. This affects FS handlers using NewVHostPathRewriter. #2487
• Rejected TLS connections no longer block the accept loop. Connections rejected by MaxConnsPerIP or Concurrency are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a ClientHello. IPv6 clients are now also counted against MaxConnsPerIP. #2486, #2468

Performance improvements

• Trailer parsing avoids quadratic work. Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted Trailer headers and chunked trailer sections while preserving trailer order. #2465

HTTP compatibility and features

• Static files handle range and conditional requests more accurately. Unsupported range units and multiple ranges are ignored instead of returning 416; invalid single byte ranges still return 416. Range is also ignored when If-Range does not match, and both Range and If-Modified-Since are ignored for methods other than GET and HEAD. #2467, #2473, #2474, #2475
• Pipeline clients handle HEAD responses without reading a body. PipelineClient skips the response body for HEAD requests. #2469
• HTTP parsing accepts valid legacy formats and matches tokens correctly. ParseHTTPDate accepts obsolete HTTP-date formats, cookies with an invalid Expires attribute remain parseable, Expect: 100-continue is matched case-insensitively, and Accept-Encoding matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. #2466, #2481, #2482, #2479, #2463
• TCP keep-alives are configurable. The new TCPDialer.KeepAlive field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. #2484

What's Changed

Security and hardening

• consume the rest of the declared body in readMultipartForm by @alhudz in https://github.com/valyala/fasthttp/pull/2336
• fix: validate outgoing request framing by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2470
• stop FS and SendFile at Content-Length when the file has grown by @alhudz in https://github.com/valyala/fasthttp/pull/2462
• fix: close the connection after a request with both Content-Length and Transfer-Encoding by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2476
• fix(fs): preserve vhost isolation during path rewriting by @koyokr in https://github.com/valyala/fasthttp/pull/2487
• Fix TLS connection rejection blocking the accept loop by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2486
• count IPv6 clients against MaxConnsPerIP by @alhudz in https://github.com/valyala/fasthttp/pull/2468

Performance

• make addTrailerKey linear in the size of the trailer set by @alhudz in https://github.com/valyala/fasthttp/pull/2465

Features

• feat: add KeepAlive option to TCPDialer by @littfed in https://github.com/valyala/fasthttp/pull/2484

Fixes

• fix(header): reject asterisk-form request-target for non-OPTIONS methods by @aadieng100 in https://github.com/valyala/fasthttp/pull/2463
• fix: accept the obsolete HTTP-date formats in ParseHTTPDate by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2466
• fix(fs): ignore Range headers FS can't serve instead of replying 416 by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2467
• skip the response body for HEAD requests in PipelineClient by @alhudz in https://github.com/valyala/fasthttp/pull/2469
• fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2474
• fix(fs): ignore Range when the If-Range validator doesn't match by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2473
• fix(fs): ignore Range for methods other than GET and HEAD by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2475
• fix(cookie): ignore an invalid Expires attribute instead of failing to parse by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2481
• fix: match the Expect: 100-continue value case-insensitively by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2482
• fix: match complete Accept-Encoding tokens by @jabrailkhalil in https://github.com/valyala/fasthttp/pull/2479

Documentation

• docs: clarify RequestURI host behavior by @oozan in https://github.com/valyala/fasthttp/pull/2355

Dependency updates

• chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2464
• chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2483
• chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2477
• chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2478
• chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2485

New Contributors

• @aadieng100 made their first contribution in https://github.com/valyala/fasthttp/pull/2463
• @LuisFigueroaG made their first contribution in https://github.com/valyala/fasthttp/pull/2466
• @oozan made their first contribution in https://github.com/valyala/fasthttp/pull/2355
• @jabrailkhalil made their first contribution in https://github.com/valyala/fasthttp/pull/2479
• @koyokr made their first contribution in https://github.com/valyala/fasthttp/pull/2487

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0