salvo

Salvo is a Rust web framework built so writing a Rust server doesn't feel like a fight with the type system. Handlers are plain async functions, middleware is just another handler, and routes nest as a tree, so auth can sit on one branch. HTTP/3, WebSockets, automatic Let's Encrypt certificates and OpenAPI docs come in the box. Apache 2.0, free.

Setup is cargo add salvo tokio, a dozen lines, cargo run. You deploy one binary that can handle its own TLS. Official crates cover CSRF, sessions, JWT auth, rate limiting, caching and a reverse proxy. No paid tier, no cloud, just a donate link. Solo, small and larger teams: free. Axum and Actix Web are the more common Rust picks; Salvo's pitch is more batteries included.

The catch: this is mostly one person's project, and only the latest release line gets security fixes. That matters, because 2026 brought four high-severity advisories: two XSS bugs in the static file listing, a proxy path traversal that bypassed gateway rules, and a memory-exhaustion DoS in form parsing. All fixed. Version 1.0 only landed in September, so pin versions and upgrade promptly.