Why build QUIC in pure JavaScript?
No OpenSSL, no native bindings, no build step. What a from-scratch JavaScript stack gives you — and what it costs.
Node.js ships HTTP/1.1 and HTTP/2 on top of native libraries. HTTP/3 has been "coming" for years, blocked largely on the TLS layer: QUIC needs access to TLS 1.3 internals that OpenSSL did not expose for a long time. QUICO takes the other road and implements everything — UDP framing, QUIC transport, TLS 1.3 (via LemonTLS), HTTP/3 and QPACK — in JavaScript.
What you get
- One install, everywhere:
npm install quico, no compiler, no prebuilt binaries per platform. - An auditable stack: every byte from UDP to HTTP/3 is code you can read, step through and log.
- Debuggability: set a breakpoint inside the handshake. Try that with a native library.
What it costs
Raw throughput. Native implementations will win benchmarks on bulk transfer, and that is fine: most services are not limited by protocol CPU, and the ones that are already run behind a proxy. QUICO is for the cases where control, portability and visibility matter more.
A familiar API
import quico from 'quico';
quico.createServer(tlsOptions, (req, res) => {
res.writeHead(200);
res.end('hello from HTTP/3');
}).listen(4433);If you have written a node:https server, you already know this one.