Starstruk Logo MarkStarstruk

http-v3.12.1

actix/actix-webhttp-v3.12.1Apr 18, 2026by JohnTitor

AI Summary

A security release addressing request smuggling vulnerabilities and fixing header encoding and iterator bugs.

Key Highlights

  • Security fix: Rejects ambiguous HTTP/1 request framing
  • Fixes HTTP/1 Connection: Upgrade header casing
  • Fixes HeaderMap iterator length and size_hint

Full Release Notes

**Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.**

- SECURITY: Reject HTTP/1 requests with ambiguous request framing from `Content-Length` and `Transfer-Encoding` headers to prevent request smuggling.
- Encode the HTTP/1 `Connection: Upgrade` header in Camel-Case when camel-case header formatting is enabled.[#3953]
- Fix `HeaderMap` iterators' `len()` and `size_hint()` implementations for multi-value headers.
- Update `rand` dependency to `0.10`.
- Update `sha1` dependency to `0.11`.

[#3953]: https://github.com/actix/actix-web/pull/3953