Standard
Third major version of the HTTP protocol, running over QUIC instead of TCP, standardized in RFC 9114 for faster, more reliable web connections.
PortSwigger has shipped HTTP/3 support in Turbo Intruder and a Burp Suite adapter, pushing more than three times the request rate it managed over HTTP/1.1 and adding two QUIC race techniques for tighter timing windows.
Reality
A dev.to guide walks Laravel apps from HTTP/1.1 to HTTP/3 on nginx, and the part worth reading twice is its admission that the middle step can hurt, because one connection carrying 40 streams stalls on one lost packet.
Reality
The typed authentication module and Netty's HTTP/3 support both arrive experimental in Ktor 3.6.0, while the changes that touch code you already wrote are two deprecations and one client Accept-header setting.
Reality
Beta 1 arrives in September with breaking changes frozen, leaving about two months of testing before general availability, and Quarkus 3.40 LTS has community maintenance until September 2027 for teams that need longer.
Reality
Unity 6.5 shipped a protocol pin whose enum tops out at HTTP/2, which tells you where the engine puts the risk. QUIC only pays for concurrent, small-object traffic, and only if your CDN negotiates it.
Reality
A new arXiv paper describes two amplification attacks that turn a CDN's HTTP/3 front end into a pump aimed at HTTP/1.1 origins. Two CDN vendors have paid bounties and shipped the authors' mitigations.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality