◉ COOLJAPAN
← All posts
August 7, 2026 • 8 min read

OxiHTTP 0.2.1 Released — Nine Security Fixes, From Redirect Credential Leaks to WebSocket DoS

OxiHTTP 0.2.1 is a security-hardening release for the COOLJAPAN Pure-Rust HTTP stack: it closes a redirect credential leak, two WebSocket unbounded-memory DoS paths, a chunked-encoding body-limit bypass, a spoofable rate-limiter key, a client decompression bomb, and more — 320 tests passing (446 with all features), the sovereign HTTP layer for the COOLJAPAN ecosystem.

release oxihttp pure-rust cooljapan noffi http security networking web

Nine security fixes in one release is not a record to be proud of — it’s a record of what a real audit finds when it stops assuming the happy path.

Today we released OxiHTTP 0.2.1 — a security-hardening release for the COOLJAPAN Pure-Rust HTTP stack. It closes a redirect credential leak, two distinct WebSocket unbounded-memory denial-of-service paths, a chunked-encoding body-limit bypass, a spoofable rate-limiter key, a client-side decompression bomb, a ServeDir symlink escape, a multipart header-injection bug, and a CORS caching-correctness gap — nine fixes, all landing in one coordinated pass.

No curl. No OpenSSL. No native-tls. No FFI, no -sys crates on the path you actually ship. OxiHTTP compiles to a single static binary with transport security handled entirely by OxiTLS — Pure Rust from the byte that hits the socket to the header that describes it.

Why OxiHTTP 0.2.1 is a game changer

A security-hardening pass earns its name by closing gaps that are easy to miss until someone goes looking for them:

OxiHTTP 0.2.1 ends all of that.

Technical Deep Dive: where the fixes live

  1. The client (oxihttp-client). The redirect same-origin check, the response-body size cap, and the bounded streaming decompressor all live here — together they close both the credential-leak and decompression-bomb classes of client-side bugs.
  2. The server (oxihttp-server). The WebSocket message-size budget (ws.rs/ws_frame.rs), the chunked-encoding BodyLimit fix, the rate limiter’s peer-address default and bucket eviction, ServeDir’s streaming file bodies and symlink protection, and the CORS Vary correctness fix all landed in this crate.
  3. The core types (oxihttp-core). Multipart header escaping for Part::text/Part::file/add_file_stream — Part::custom remains the documented, unsanitized escape hatch for callers who need fully custom headers.
  4. New fuzz coverage (fuzz/, unpublished workspace). ws_frame_read, cookie_parse, range_header, and multipart_build — coverage-guided cargo-fuzz targets that exercise exactly the parsers this release hardened.

Getting Started

cargo add oxihttp

The client and server API is unchanged in 0.2.1 — every fix in this release is a security correction, not a surface change:

use oxihttp::prelude::*;

// Client: response body size is now capped by default (64 MiB)
let client = Client::builder()
    .with_tls()
    .with_retry(RetryPolicy::default())
    .build()?;

let body: serde_json::Value = client
    .get("https://httpbin.org/json")
    .send()
    .await?
    .json()
    .await?;

use oxihttp::prelude::*;

// Server: WebSocket reassembly and single-frame size are now bounded
let router = Router::new().get("/ws", |req| async move {
    let mut ws = req.upgrade_websocket().await?;
    ws.set_max_message_size(4 * 1024 * 1024); // 4 MiB, tighter than the 16 MiB default
    Ok(ws)
});

Server::builder().bind("0.0.0.0:8080").serve(router).await?;

What’s New in 0.2.1

Tips

This is the foundation

OxiHTTP is part of NoFFI — the COOLJAPAN initiative to replace every C/C++/Fortran/-sys FFI dependency in the Rust world with a clean, memory-safe, 100% Pure Rust implementation. A security-hardening release that closes nine real gaps in one pass is exactly the kind of work that keeps that promise credible for production traffic, not just for a demo.

It stands shoulder to shoulder with its siblings: OxiTLS for transport security, OxiQUIC for QUIC/HTTP-3 transport, and OxiARC for compression — with OxiStore, OxiRPC, and a growing list of COOLJAPAN projects carrying it as their HTTP client layer.

Repository: https://github.com/cool-japan/oxihttp

Star the repo if a Pure-Rust HTTP stack that treats a redirect credential leak and a WebSocket DoS as equally unacceptable is something you’ve been waiting for.

The era of shipping HTTP security fixes one CVE report at a time is over. Pure Rust HTTP — audited, hardened, and sovereign — is here.

— KitaSan at COOLJAPAN OÜ August 7, 2026

↑ Back to all posts