node-reqwest

Node.js bindings for reqwest - Rust HTTP client library. Implements the full undici.Dispatcher interface (including its error classes), passes the same web-platform tests undici does, and outperforms it on HTTP/2. Ships with system proxy, system CA certificates, and Electron compatibility built in.

Install

npm install node-reqwest

Prebuilt binaries are shipped for macOS, Linux, and Windows on x64 and arm64. Requires Node.js ≥ 22.12 and undici ≥ 8 as a peer dependency.

Usage

Agent implements the undici.Dispatcher interface. Use it as a global dispatcher for fetch, or with any undici-compatible API.

import { Agent } from "node-reqwest";
import { setGlobalDispatcher } from "undici";

const agent = new Agent({
    allowH2: true,
    proxy: "system", // also accepts "none" or { type: "custom", uri, auth? }
});

setGlobalDispatcher(agent);

// All fetch calls now use reqwest under the hood
const response = await fetch("https://example.com");

Why node-reqwest?

| Feature | node-reqwest | Node.js / undici | | ---------------------- | ---------------------------------------- | ------------------------------------------------------------------------- | | DNS resolver | Async pure-Rust (hickory-dns) | C (c-ares) - crashes Electron on Windows for nonexistent domains | | System CA certificates | Built-in | Requires win-ca, mac-ca | | System proxy | Built-in | Not available (complex Electron workaround) | | SOCKS proxy | Built-in | Not available | | HTTP/2 | Multiplexed via hyper | Implemented, but materially slower (see benchmarks) | | TLS | rustls | OpenSSL |

Benchmarks

Throughput vs. undici on the same workload. The conservative number between two timed runs (with a warm-up run discarded):

| Scenario | node-reqwest vs. undici | | ------------------------- | ----------------------- | | HTTP/1 GET | at parity | | HTTP/1 POST (stream body) | +5% | | HTTP/2 GET | +50% | | HTTP/2 POST (stream body) | +55% |

HTTP/1 GET, the tightest hot path, lands within run-to-run noise of undici (mean throughput; p50 favors node-reqwest by 3–7% but tail latency is GC-jittery on both sides). The HTTP/2 numbers are where the multiplexing wins show up.

The benchmark suite lives in packages/node/benchmarks/. Each scenario starts a loopback HTTP/1 or HTTP/2 server (using selfsigned for HTTP/2 TLS) and drives 100 parallel dispatches per iteration via vitest's bench() runner; warm-up dispatches prime the connection pool and JIT before timed samples.

To reproduce locally:

git clone --recurse-submodules https://github.com/vadimpiven/node_reqwest.git
cd node_reqwest
mise install           # installs Node, Rust, pnpm via the pinned toolchain
pnpm install
pnpm --filter node-reqwest run bench

pnpm run bench builds the Rust addon first (via prebench), then executes every *.bench.ts file in packages/node/benchmarks/. Each run prints per-bench hz (ops/sec), latency percentiles, and a "Nx faster than" summary comparing the two dispatchers.

The README numbers are the conservative result between two consecutive runs (the worst-for-node-reqwest ratio), with a discarded warm-up run preceding them. Absolute throughput depends on your machine; the ratio between the two dispatchers is what's stable across hardware.

Supported platforms

| OS | Architectures | | ------- | -------------- | | macOS | x64, arm64 | | Linux | x64, arm64 | | Windows | x64, arm64 |

• Node.js ≥ 22.12
• Peer dependency: undici ^8

Prebuilt binaries are published as part of every release; there is no source build step on npm install. Linux prebuilds target manylinux_2_28 (glibc ≥ 2.28).

Limitations

Agent covers the undici.Dispatcher request/stream/pipeline surface, but a few features are deliberately out of scope. See COMPATIBILITY.md for the full matrix and error mapping.

• No CONNECT / Upgrade, so no WebSockets and no HTTP tunneling. Use undici's WebSocket / ProxyAgent for those.
• No HTTP trailers, no drain event, no pipelining knobs. reqwest manages the connection pool internally, so the corresponding Dispatcher options are no-ops.
• No request retries. Bodies are streams; retry at the application layer.

Supply chain

This package downloads a precompiled binary during npm install. GitHub releases for this project are immutable - once published, release assets cannot be modified or replaced, ensuring that the binary you download is the same one that was originally published.

In addition, the postinstall script uses node-addon-slsa to cryptographically verify that the binary was built in the same GitHub Actions workflow run as this npm package, using sigstore provenance attestations and the GitHub Attestations API.

Installation aborts with a SECURITY error if any check fails.

License

Apache-2.0 OR MIT