Trust model

Velociradix is a native HTTP engine. Install it only if you accept that.

Custom parser (not llhttp)

Every request is parsed in C++ on a worker thread. The parser is this project’s code, not Node’s llhttp.

8.1–8.2 added smuggling and DoS guards (no Transfer-Encoding, Host required, header/URI caps, Slowloris idle timeout, connection cap). Those are checks we wrote. They are not a substitute for a parser with years of internet fuzzing.

Use 8.2.0 or newer if the process is reachable from the internet. Prefer Fastify/node:http if you need llhttp’s history more than this engine’s threading model.

Full table: security guide and SECURITY.md.

Native addon

The package ships or builds a .node file. A memory bug can kill the process. try/catch in JavaScript will not save you.

Prebuilds exist for Linux x64, macOS arm64, and Windows x64. Official npm publishes use GitHub Actions OIDC provenance. You still trust this repository and that CI.

Zero npm runtime dependencies cuts the JS supply chain. It does not cancel native-binary risk.

What was removed or gated (on purpose)

API	Status
app.ws()	Removed. It never was a WebSocket.
app.graphql()	Experimental, POST-only, not a GraphQL server.
swagger / metricsUI / postmanDoc	Require { expose: true } in production.
download / sendFile	Require root in production.

8.x line

Majors will not be used to ship features. Install the latest 8.x from npm (npm install velociradix). Policy: versioning.