Neo SPCC has released NeoFS S3 Gateway v0.45.1 on August 4. This patch update introduces three performance optimizations and a metadata fix to the S3-compatible interface for the NeoFS decentralized storage network. Because the Amazon S3 API has become the de facto standard for object storage across both centralized and decentralized platforms, improvements to S3 gateway throughput and correctness directly affect how easily developers can migrate or build applications on NeoFS using familiar tooling.

Two of these performance enhancements are powered by the NeoFS SDK Go RC21, which was released just days prior alongside NeoFS Node v0.55.0.

Building upon the major July release of S3 Gateway v0.45.0—which brought namespace configuration, simplified EACL rules, and the removal of legacy access box support—this new patch requires no migration for existing v0.45.0 users.

Write Buffering and Ranged GET Optimizations

The first optimization implements the io.ReaderFrom interface for the object payload writer, a capability introduced in SDK RC21. By removing at least one intermediate data copy during PUT operations, this update lowers memory allocation and CPU overhead on the write path (#1320).

The second optimization improves ranged GET requests. Previously, these requests demanded a separate round-trip to fetch the object header before retrieving the specified range of data. Leveraging SDK RC21's HTTP-alike byte range parameters, the gateway can now retrieve both the header and the ranged payload in a single network call (#1319). This enhancement significantly benefits streaming media, partial downloads, and multipart upload workflows that depend on S3 range reads.

Extended Access Control Lists Applied During Container Creation

Extended Access Control Lists (EACL) are now applied simultaneously with container creation in a single network call, eliminating the need for a follow-up request (#1304). This adjustment reduces latency during S3 bucket creation and closes a brief vulnerability window where a newly created container could exist without its designated access policy.

System Attributes Correction

A crucial correctness fix filters out internal NeoFS system attributes from GetObject metadata responses (#1321). In earlier versions, these protocol-level attributes were included with user-defined metadata in S3 responses, inadvertently exposing internal implementation details to clients. The fix ensures that only user-defined metadata is returned, aligning the system with expected S3 API behavior and reducing the risk of information leakage in multi-tenant deployments.

Dependency Updates

Alongside the SDK RC21 upgrade, version 0.45.1 incorporates various security and maintenance updates, including:

• golang.org/x/crypto v0.52.0
• golang.org/x/net v0.55.0
• google.golang.org/grpc v1.82.1

The gRPC update specifically addresses mitigations for HTTP/2 frame flood denial-of-service attacks and resolves authorization bypass scenarios found in xDS permission matching. These classes of HTTP/2 vulnerabilities have seen active exploitation across the broader infrastructure ecosystem, making timely dependency updates a baseline security practice for storage gateways exposed to untrusted clients.

The full release notes are available here: https://github.com/nspcc-dev/neofs-s3-gw/releases/tag/v0.45.1