ferronweb/ferron 3.0.0-rc.6 on GitHub

HTTP/2 and overall memory usage optimizations: optimized both reverse proxying and HTTP/2 for lower memory usage, and fine-tuned default jemalloc memory allocator settings.

Lazy observability event channels: the console, file, OTLP, Prometheus, and StatsD backends now allocate their event channels only when selected by the configuration, instead of pre-allocating ~4 MB each at startup. Idle servers without observability configured use ~20 MB less memory.

Access control bugfix: fixed access control bug that allowed unauthorized access to the admin API (/reload was gated by reload_get instead of reload before the bugfix).

Routing bypass fix: previously, a specially-crafted request (with URL-routing) could bypass routing and access files on unintended paths.

Connection pool memory leak fix: fixed connection pool memory leak that occurred when connection is returned to the pool (after proxy received the initial response from an upstream).

PATH_INFO fix: a bug introduced in 3.0.0-rc.4 caused PATH_INFO to not be sent at all by default due to an incorrect check.

http_version subdirective fix: the http_version subdirective now correctly sets the HTTP version for forwarded requests.
DNS rebinding protection fix: the forward proxy now rejects with 403 (instead of passing the request through to the normal pipeline) when a destination hostname resolves to a denied IP or DNS resolution fails, on both the CONNECT tunnel and absolute-URI forwarding paths. The stage also fails closed with an error status if any other proxy error leaves no response set.
Hop-by-hop header stripping fix: hop-by-hop headers are now stripped from forwarded requests per RFC 7230 section 6.1, so to not forward them to the upstream server.