Month: November 2026

ngtcp2 1.26.0 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

Major changes:

• doc: Add pseudo code and documentation for writing packets with GSO
• build(deps): bump actions/stale from 10 to 11
• Cleanup
• No stream is closed just because STOP_SENDING is received
• Restructure conn
• Tighten long header packet length check for 32-bit platform
• map: Remove key if resizing table fails
• examples/server: Check QUIC version
• Add callback for extendmaxdata
• Update callback tests
• Do not retire the fallback DCID if it is still used
• Fix CUBIC CWND increment function
• Call extend_max_data on handshake completion
• Return STREAM_LIMIT error if the limit is violated by STREAMS_BLOCKED
• Add ngtcp2_conn_tx_strmq_push_if_not
• Send STREAM_DATA_BLOCKED/DATA_BLOCKED when data is actually blocked
• Update doc
• Simplify ngtcp2_conn_write_stream
• Rework the incoming NEW_CONNECTION_ID validation
• Assert that ngtcp2_conn_tls_early_data_rejected only called from client
• Return NGTCP2_ERR_STREAM_STATE for RESET_STREAM against local uni stream
• Remove the code that handles the case that is too large for UDP datagram
• Rename offset in ngtcp2_data_blocked and ngtcp2_stream_data_blocked
• Add transport parameters decode tests
• Add more transport parameter decoding tests
• Add wf test
• Add test for resending NEW_TOKEN
• Rtb test
• Simplify conn test
• GHA: Bump Ubuntu to 26.04
• Examples rewrite tests with new munit cxx assertions
• Bump clang-format to 21
• GHA: Bump clang to 21
• Use packaged ossl
• GHA: Reduce openssl1/3 jobs
• GHA: Reduce cmake jobs
• GHA: Fix quic interop runner
• Tweak the maximum value of ngtcp2_ratelim.burst
• Fix slow start pacing gain
• Reset max UDP payload size when the peer’s IP address changes
• Check picotls encryption level
• Check ossl encryption level
• Server should send CONNECTION_CLOSE in earlier level
• GHA: Use libressl for macos build
• Add oss-scanner files
• examples/client: Fix div by zero
• examples/server: Do not truncate file sizes on 32-bit targets
• Limit token length
• Add 0 length STREAM frame filter to rtb_reclaim_on_retry
• Fix max decryptable pkt num marker before first decryption
• Penalize the short stream data write
• Optimize ngtcp2_rtb_reclaim_on_pto
• ngtcp2_conn_write_aggregate_pkt2: Check path to end aggregation
• Bump libressl to v4.4.0
• send_quantum should be at least single MTU
• Use validated_path before it is gone
• Graceful connection closure when 1 RTT key is installed more than once
• Process 0RTT packet only after 0RTT and 1RTT keys are available
• Limit client’s PATH_RESPONSE to the unvalidated path
• Explicitly verify path validation timeout
• Make PATH_RESPONSE PTO eliciting
• Reclaim connection level flow control window in stream close for RESET_STREAM
• Refine ngtcp2_rob fragmentation threshold detection
• Deal with the early HANDSHAKE_DONE from server
• Improve map hasher
• Rearm loss timer after it is cancelled by anti-amplification limit
• Properly handle the case when client migrates back to the original path
• Do not start pv round if no PATH_CHALLENGE is sent
• Make ngtcp2_pkt_decode_version_cid return error on zero input
• Keep congestion state if nothing has been delivered
• Deal with TLS stack that does not bail out without transport params
• Fix packet number decoding
• Deal with the connection ID limit error
• Reject ACK that acknowledges packet that is sent later
• Remove rejection from handshake address because it is unreliable
• Reset ppe pending state without WRITE_MORE flag set
• Deal with stream shutdown in stop_sending callback
• Revert “Stop buffering data after shutting downstream read”
• Prevent a used DCID from being retired
• Avoid abandoned DCID stranded
• Return error when ngtcp2_conn_initiate_key_update called during handshake
• Avoid DCID reuse
• Derive initial key before version is negotiated
• Prevent a used DCID from being retired in the another way
• Do not call dcid_status callback until handshake completes
• Revert “Make sure that NGTCP2_CONN_FLAG_PPE_PENDING is not leaked”
• Do not block PATH_RESPONSE due to lack of DCID and credit
• Reset CUBIC undo variables once a loss is confirmed
• Fix conn_shutdown_stream_read
• Tweak key update confirmation
• Fix memory leak
• Count decryption failures for Handshake and 0RTT keys
• examples/server Fix handler leak
• Install preferred address before reading server 0.5RTT packets
• Ensure at least 1 byte frame is allocated on encoding
• Count empty STREAM frame toward glitch counter
• Do not clear PTO eliciting flag
• Fix bug that lost_datagram is not called
• crypto/ossl: Guard tx_level from 0RTT as well
• hqclient: Remove streams on close
• Fix 0RTT key not discarded with callback
• Send the control frames in 0RTT
• Revert “Count empty STREAM frame toward glitch counter”
• Fix invalid qlog with PADDING only packet
• Deal with out of memory after getting Connection ID
• Remove problematic glitch counter for some frames
• Write stream data thresh
• Fix ngtcp2_vec_merge
• Stop the path validation upfront
• Simplify map insert
• Bump tls deps
• Fix heap overruns when malloc is only 4-byte aligned (like on ESP32)
• examples: Deal with if_indextoname failure
• GHA: Remove macos-15

The ngtcp2 library stack is built against OpenSSL 4.0.3, and the QUIC client is named osslclient.