Flare v0.13.0 was just released and is packed with a lot of improvements. It’s also ranked high in HttpArena.
flare is the only framework that places in the top 4 of HTTP/2, HTTP/3, gRPC and WebSocket at once (7th HTTP /1.1). Among all five protocol families, it also has the highest combined score.
Check the stack rankings HTTP Web Server Benchmarks – HttpArena
Or compare against say actix Web framework comparison: any two entries, any language – HttpArena
Some highlights of v0.13.0:
- HTTP/3 runs on every core. It scales across N workers with HMAC-routed connection IDs. It now supports DATAGRAM, ECN, key update, path-MTU discovery and NEW_TOKEN. With 1 client and 100 streams it goes from 0.84x to 1.25x quiche’s throughput.
- WebSocket is served on the reactor and over HTTP/3 (RFC 9220). One sans-I/O core handles HTTP/1.1, HTTP/2 and HTTP/3. The Autobahn known-fail list went from 42 to 0, and a 16 MiB message now takes 65 ms instead of 3.9 s.
- Big speedups across protocols. h2c went from 650K to 3.81M req/s, pipelined HTTP/1.1 from 2.2M to 8.6M req/s, and an HTTP/3 bulk download from 45 to 570 MB/s.
- The Lean 4 models are tied to the shipped code. Each model’s anchor stores a hash of the Mojo symbols it mirrors, a pre-commit gate blocks changes that leave a pinned anchor stale, and differential tests run the models against the real code. New proofs cover the WebSocket protocol core against RFC 6455 and the io_uring buffer-ring ledger.
- Security hardening. QPACK decoders now cap the decoded header size, closing the decompression-bomb class behind CVEs in quic-go and quiche. Brotli and rustls have CVE fixes, and bind_tls adds SNI certificates, hot reload and an enforced minimum TLS version.
