Rust Web Frameworks

httpreleasemiddleware

Summary

  • axum leads on both adoption and maintainer count. Quite low level, only crate docs. Still pre 1.0.

  • actix-web uses its own http stack. Higher level.

  • salvo is only framework with HTTP/3 and WebTransport. One maintainer (91%), but looks promising.

Comparison

VersionReleasedHTTP coretower90d downloadsHumans/12mo
axum0.8.92026-04-14hyper 1.xnative103,898,17385
actix-web4.14.02026-06-21own, http 0.2no9,182,73730
warp0.4.32026-05-04hyper 1.xnative4,686,736-
salvo0.95.12026-07-29hyper 1.xbridge1,253,70719
Rocket0.5.12024-05-23hyper 0.14no1,172,65910
poem3.1.122025-07-28hyper 1.xbridge (0.4)756,50420
ntex3.12.02026-07-30ownno94,88713
loco-rs1.0.12026-07-31via axumnative91,93928

tower column: native is a tower::Service, so tower-http middleware applies directly; bridge is a compatibility layer (poem’s targets tower 0.4, a major behind); no means the tower ecosystem is out of reach and every concern needs a framework-specific crate.

axum

0.8.9 (2026-04-14). 26,780 stars, 7,710 reverse dependencies, 410M downloads lifetime and 104M of them in the last quarter.

Built by the Tokio team on hyper 1.4, http 1.5, tower 0.5 and tower-http. WebSockets and SSE are first-party. #![forbid(unsafe_code)]. MSRV 1.80.

Verified in production: crates.io itself pins axum = "=0.8.9", and Lichess runs at least five axum services. tonic declares axum ^0.8 as a normal dependency, so every Rust gRPC user pulls it in regardless of choice. JetBrains shipped axum-specific IDE support in RustRover 2026.2 (2026-07-23), which no other Rust framework has.

Development is active: 298 human commits across 85 contributors in the last year, last commit 2026-08-04, only 10 open issues predating 2024. Releases are another matter - two breaking versions in three years and no 1.0:

  • 0.7.0 (2023-11-27) migrated to hyper 1.0 and removed Server.
  • 0.8.0 (2025-01-01) changed path syntax from /:id to /{id}; the announcement calls it “a breaking change for basically all axum users”. The old form now panics. Option<Path<T>> semantics changed. Three weeks later 0.8.2 was yanked.
  • 0.9 sits unreleased on main. Asked for a timeline on 2026-06-30, the maintainer answered “there isn’t any set timeline”. axum-extra broke three more times inside the 0.8 line.

One blocker on 1.0 is external: axum exposes tower_layer and tower_service types in its public API, and tower is still 0.5.3. The tower-service 1.0 tracking issue has been silent since October 2024.

Original author David Pedersen wrote 6 of the last 298 commits; the project is now run day to day by tottoto, jplatte, mladedav and yanns.

trial

actix-web

4.14.0 (2026-06-21). 24,764 stars, 1,644 reverse dependencies, 9.2M downloads in 90 days.

Zero breaking releases since 4.0.0 on 2022-02-25: four and a half years, eleven minor releases, no yanks, and migration guides checked into the repository (MIGRATION-4.0.md and predecessors). No other framework here matches that record.

It does not use hyper. actix-http is its own HTTP implementation on actix-rt/actix-server over tokio, which produces the thread-per-core throughput profile. actix-rt’s own documentation notes that idle threads do not steal work from backlogged ones.

Two consequences of being off the tower graph:

  • http 0.2. actix-http depends on http 0.2.7 and h2 0.3.27, while reqwest 0.12, tonic, tower-http and axum are on http 1.x. Mixing them requires hand-written conversion shims and puts two HTTP/2 stacks in the binary. This is the declared blocker for v5, open as issue #3384 since 2024-05-31. HTTP/3 is unsupported; that issue dates from 2018.
  • Separate crates per concern. No tower-http, so actix-cors, actix-session, actix-governor, actix-web-prom and tracing-actix-web are needed instead. Most are maintained but slower than the core: actix-web-httpauth has not released in 26 months, actix-cors in 17. SSE exists only in actix-web-lab, which sits in a maintainer’s personal namespace and which Meilisearch and Rauthy depend on in production. There is no actix-native gRPC.

355 commits in the last year, 207 of them dependabot; two humans wrote 78% of the remainder, and the nominal lead commits about twice a month. 157 open issues, 74% predating 2024.

Verified production users: Meilisearch and Qdrant, both direct dependencies at 4.13/4.14. The “used by Microsoft and Cloudflare” claim in circulation is asserted nowhere by the project and could not be verified.

Two things to know: actix-web-actors is deprecated in its own version string (4.3.1+deprecated) yet still outdownloads its replacement actix-ws; and MSRV jumped to 1.88 in a minor release, 4.13.0.

assess

salvo

0.95.1 (2026-07-29). 4,414 stars, 1.25M downloads in 90 days - more than Rocket or Poem.

It is the only framework here with HTTP/3 and WebTransport, alongside ACME automatic TLS certificates and in-tree OpenAPI generation. Neither axum nor actix-web has an HTTP/3 story, and h3 upstream is still 0.0.8; salvo maintains its own fork. salvo-oapi does 412k downloads a quarter.

Stack is hyper 1 and http 1, with a tower-compat bridge on tower 0.5 for tower-http middleware. Releases land continuously; there is still no 1.0 after six years.

498 commits in the last year, 91% by chrislearn.

assess

Rocket

0.5.1, published 2024-05-23. 25,775 stars. Downloads are still rising - 458k in July 2026, up 56% over the quarter.

rocket_http 0.5.1 depends on hyper ^0.14.9, http ^0.2 and rustls ^0.21, which excludes it from tower-http and from type sharing with anything on http 1.x. master has completed the hyper 1.1 migration and is 244 commits ahead, unreleased.

Release and governance state:

  • No commits in calendar 2026. Last commit 2025-12-28; 14 commits in the last twelve months, thirteen of them on a single day.
  • On 2025-05-25 the active maintainer wrote that he planned to release 0.6-rc.1 “once I have access to do so”. All 58 published versions were pushed by Sergio Benitez, who has made one commit since December 2024. Fourteen months later there is no release candidate.
  • The RWF2 foundation, announced in November 2023 to address this, has taken in $5,559 lifetime, holds a $0 balance, received its last contribution on 2024-03-11, and has published no roadmap or update. The rocket.rs news page has been silent since the v0.5 announcement.
  • Issue #2998 (2026-06-10) reports RUSTSEC advisories against the rustls-webpki version Rocket pulls in. No maintainer response; no in-line fix is possible, since clearing it requires a release. The affected code paths are unlikely to be reached by a normal server, so it blocks scanners rather than exposing a live exploit.

Ecosystem: rocket_cors untouched since November 2023; rocket_okapi pins rocket = "=0.5.1" exactly and will break on any 0.6; rocket_jwt and rocket_session do 173 and 142 downloads a quarter. No named company running Rocket in production could be verified.

Poem

3.1.12, published 2025-07-28. 4,427 stars, 756k downloads in 90 days and falling - 287k in May, 241k in June, 211k in July.

poem-openapi derives a spec-compliant OpenAPI v3 document from handler types, with Swagger UI, Scalar, RapiDoc and Redoc renderers included; roughly half of all Poem users pull it in. The rest arrives as cargo features rather than third-party crates - sessions, CSRF, Prometheus, OpenTelemetry, compression, WebSockets, SSE, i18n, ACME - so there is one version and one changelog to track. Stack has been hyper 1 since 2.0.0 in January 2024.

Fifty commits landed in the last year, including a fix for RUSTSEC-2025-0134 merged 2026-08-03. None is published, so every user runs a release carrying an unmaintained dependency. The maintainer commits daily to his employer’s repositories and is the sole crates.io owner. A crate in the repository, poem-worker, has never been published.

There is no authentication crate and no rate limiting, and the released version’s tower bridge targets tower 0.4 while the rest of the field is on 0.5. Verified production users - Databend, Aptos, Warpgate, Golem - are all pinned to 3.0 or 3.1.x.

poem-oauth2, poem-jwt-auth, poem-casbin and poem-prometheus appear in older documentation; none exists on crates.io, and the first three never did.

Other frameworks

  • loco-rs 1.0.1 - “Rails for Rust”, on axum and SeaORM, with generators, migrations, background jobs and mailers. First stable release 2026-07-29.
  • warp 0.4.3 - maintained, contrary to several comparison sites. Did the hyper 1.x port in 0.4.0 (2025-08-05); 4.7M downloads a quarter.
  • ntex 3.12.0 - by Nikolay Kim, actix-web’s original author. Pluggable runtimes including io_uring and compio. 90% one person.
  • cot 0.7.0 - Django-shaped, on axum, with its own ORM and an admin panel. 3,462 downloads a quarter; breaking changes every release.
  • xitca-web 0.8.1 - tops the TechEmpower Rust entries. 95% one person, ~3k downloads a quarter.
  • trillium 1.3.0 - Tide’s successor, written by a Tide contributor after async-std was discontinued; RUSTSEC points Tide users here. 99% one person.
  • rama 0.3.0 - a service framework for proxies and network middleboxes with TLS fingerprinting and MITM, not a web framework.
  • picoserve - no_std async HTTP for bare metal and embassy.
  • pavex - compile-time dependency injection generating a plain Rust server. No release in nine months, no commits in three.

Framework-agnostic crates

Most of the concerns below are solved by crates that do not depend on a web framework.

Foundation. hyper 1.11.0 (179.8M/90d), tower 0.5.3 (151.2M), tower-http 0.7.0 (117.8M) - tower-http is downloaded more than axum. tower has not reached 1.0; its tracking issue has been quiet since October 2024.

OpenAPI. utoipa 5.5.0 is the default, framework-agnostic with opt-in extras per framework. Its satellites lag: utoipa-axum frozen at 0.2.0 since January 2025, utoipa-swagger-ui since May 2025. aide is the axum-specific alternative and changed hands to jplatte. In-tree generation exists in salvo-oapi and poem-openapi.

Auth. jsonwebtoken 11.0.0 for JWT at 39.5M downloads a quarter, an order of magnitude ahead of alternatives, with two breaking majors in ten months (pluggable crypto backends in 10.0, #[non_exhaustive] enums in 11.0). For OAuth2 and OIDC, oauth2 5.0.0 and openidconnect 4.0.1, both from ramosbugs; the second has had two commits in the last twelve months. For sessions, tower-sessions 0.15.0 - axum-sessions has been dead since 2023.

Authorization. cedar-policy 4.12.0 took a third of its lifetime downloads in the last quarter. casbin 2.20.0 is now an Apache incubating project. Oso is deprecated by its vendor - the repository description reads “Deprecated: See README” and there has been no release since January 2024. Both live options are policy engines called from your own extractor; neither ships one.

Observability. tracing 0.1.44 is universal, and tower-http’s TraceLayer works with any tower::Service (actix-web needs tracing-actix-web). OpenTelemetry has not shipped 1.0: opentelemetry is at 0.32.0, where logs and metrics are stable but distributed tracing is still Beta. It takes a breaking minor every three to four months and drags tracing-opentelemetry with it.

gRPC. tonic 0.14.6 is the working choice. The repository moved to grpc/grpc-rust under the CNCF in May 2026 and the maintainers state it is “not accepting any significant new features”. The official successor grpc 0.9.0 shipped 2026-05-28 and does 28k downloads a quarter against tonic’s 80.9M.

Database. Framework-agnostic; the framework only decides how the pool is injected. sqlx 0.9.0 shipped 2026-05-21 and the repository moved from launchbadge to transact-rs; the maintainers describe it as “in dire need of more support and resources” and it carries 770 open issues, while remaining the most-used option by a factor of five. sea-orm 2.0.1 landed 2026-08-02 after 43 release candidates with a new entity format, so material written before August 2026 describes the old one. diesel 2.3.11 plus diesel-async at 3.5M downloads means diesel is no longer sync-only. See also Databases.

Validation. validator 0.21.0 leads on volume eight to one; garde 0.23.0 is more active (50 commits against 11). Both are agnostic derive macros; only the extractor wrappers are framework-specific.

Templates. rinja merged back into askama - rinja’s final version is 0.4.0+deprecated, the original askama repository was archived in March 2025, and the live one is askama-rs/askama at 0.16.0. Askama removed its per-framework integration crates in the process; templates render to a String that the handler returns. tera reached 2.0 in June 2026. minijinja and maud are the other live options.

Fullstack. Leptos and Dioxus both run on axum server-side (leptos_axum, dioxus-server), so choosing one inherits axum rather than replacing the decision. Both are mid-major-transition.

MCP. rmcp 3.1.0, the official Model Context Protocol SDK, went from zero in February 2025 to 9.35M downloads a quarter. Built on hyper and tower, and needs no framework.

Related