Embedded HTTP Servers in C in 2026: Mongoose vs CivetWeb vs GNU libmicrohttpd

Your next product probably needs an HTTP server, and it probably does not need nginx. When the web server lives inside your firmware, your desktop tool, your router admin panel, or your test harness, the right move is an embeddable HTTP library: a C library that links into your process, opens a port, and exposes your functions as routes. The three serious contenders in 2026 are Mongoose (13,025 GitHub stars), CivetWeb (3,447 stars), and GNU libmicrohttpd — and they differ far more than their similar APIs suggest.

Choose wrong and you discover it late: the GPL license that kills your commercial SDK, the threading model that fights your event loop, or the TLS stack you cannot swap. This guide compares the three with real code from the official repositories so you can decide in one sitting.

TL;DR — Which Embedded HTTP Library Should You Pick?

Pick Mongoose if you target microcontrollers or need a tiny single-file server with a built-in network stack — it is the only one of the three that runs on bare-metal MCUs, but its dual GPLv2/commercial license matters if you sell closed-source products. Pick CivetWeb if you want a permissively licensed (MIT core), multi-threaded, handler-based server with batteries included — CGI, TLS, WebSockets, and a C++ wrapper out of the box. Pick GNU libmicrohttpd if you need the cleanest LGPL story for a proprietary application and prefer to own the I/O loop yourself.

Mongoose vs CivetWeb vs libmicrohttpd: The 2026 Comparison

Decision matrix — 10-second pick

Mongoose — The Single-File Server That Runs on a Microcontroller

Mongoose is the oldest name here and the most unusual: the whole server is two files (mongoose.c and mongoose.h) that you drop into any project — from a 40 MHz MCU to a Linux service. Its site describes it as an “embedded web server and web UI framework for microcontrollers,” and it genuinely runs on bare metal, where it can even bring its own TCP/IP stack when the silicon has none.

The programming model is a single-threaded event loop. The official README example starts a server with a REST endpoint that returns the current time:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

static void ev_handler(struct mg_connection *c, int ev, void *ev_data) {
  if (ev == MG_EV_HTTP_MSG) {
    struct mg_http_message *hm = (struct mg_http_message *) ev_data;
    if (mg_match(hm->uri, mg_str("/api/time/get"), NULL)) {
      mg_http_reply(c, 200, "", "{%m:%lu}\n", MG_ESC("time"), time(NULL));
    } else {
      mg_http_reply(c, 500, "", "{%m:%m}\n", MG_ESC("error"), MG_ESC("Unsupported URI"));
    }
  }
}

The surrounding main() shows the whole lifecycle — initialize an event manager, attach a listener, and poll forever:

1
2
3
4
5
6
7

struct mg_mgr mgr;  // Declare event manager
mg_mgr_init(&mgr);  // Initialise event manager
mg_http_listen(&mgr, "http://0.0.0.0:8000", ev_handler, NULL);  // Setup listener
for (;;) {          // Run an infinite event loop
  mg_mgr_poll(&mgr, 1000);
}
return 0;

Strengths: absurd portability, tiny footprint (tens of KB), WebSocket/MQTT/HTTP client and server in one amalgamation, and an event-driven design that needs no threads and no locks. Cesanta pushes updates almost daily (last push September 3, 2026).

Costs: the dual GPLv2/commercial license — the LICENSE file states the code is “dual-licensed” under GPLv2, and commercial use of Mongoose in proprietary products requires a paid Cesanta license. Also, the event-loop style inverts how many C developers think about servers: every blocking call in a handler stalls the whole server, so file I/O and crypto must be used carefully.

CivetWeb — The Permissively Licensed Multi-Threaded Workhorse

CivetWeb began life as a fork of an early Mongoose release and has since grown into its own mature project: a multi-threaded C/C++ web server that embeds in a few lines. Where Mongoose hands you an event loop, CivetWeb hands you threads — each connection is handled concurrently, so your handlers can block on file or database I/O without stalling other clients.

The official embedded_c example shows the startup pattern:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

/* Start CivetWeb web server */
memset(&callbacks, 0, sizeof(callbacks));
callbacks.log_message = log_message;
ctx = mg_start(&callbacks, 0, options);

/* Check return value: */
if (ctx == NULL) {
    fprintf(stderr, "Cannot start CivetWeb - mg_start failed.\n");
    return EXIT_FAILURE;
}

/* Add handler EXAMPLE_URI, to explain the example */
mg_set_request_handler(ctx, EXAMPLE_URI, ExampleHandler, 0);
mg_set_request_handler(ctx, EXIT_URI, ExitHandler, 0);

options is a NULL-terminated array of key/value strings — the example configures a document root and listening ports with a compact syntax where r/s suffixes toggle HTTP vs HTTPS per port: "8888r,8843s,8884" serves HTTP on 8888, HTTPS on 8843, and plain HTTP on 8884 simultaneously. One process, many protocols, no virtual-host gymnastics.

Beyond the C API, CivetWeb ships CivetServer, a C++ wrapper class, plus optional Lua server pages, CGI support, digest authentication, WebSocket handlers, and an SSL layer that works with OpenSSL, wolfSSL, or mbedTLS. The project is quiet-but-alive — last push August 1, 2026 — and its stability is the feature: the API has barely churned in a decade.

Strengths: permissive licensing (the example sources state the MIT License), concurrency for free, static files + handlers + TLS in one API, huge feature surface.

Costs: heavier than Mongoose (multi-file build, more RAM per connection), less at home on bare-metal MCUs, and the thread-per-connection model is a poor fit for event-driven architectures with tens of thousands of connections.

GNU libmicrohttpd — The Library That Stays Out of Your Way

GNU libmicrohttpd (MHD) takes the most conservative design position: it is a C library that implements HTTP 1.1 parsing and responses, period. It does not want your main loop, does not serve static files for you, and does not decide your threading strategy — you pass it a callback and choose one of several run modes (external event polling, internal thread per connection, or a fixed thread pool). That makes it the favorite of projects like GNUnet that need an HTTP server integrated into an existing event architecture.

The canonical “hello browser” example from the official sources is delightfully small:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

static enum MHD_Result
answer_to_connection (void *cls, struct MHD_Connection *connection,
                      const char *url, const char *method,
                      const char *version, const char *upload_data,
                      size_t *upload_data_size, void **req_cls)
{
  const char *page = "<html><body>Hello, browser!</body></html>";
  struct MHD_Response *response;
  enum MHD_Result ret;

  response = MHD_create_response_from_buffer_static (strlen (page), page);
  ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
  MHD_destroy_response (response);

  return ret;
}

int
main (void)
{
  struct MHD_Daemon *daemon;

  daemon = MHD_start_daemon (MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD,
                             PORT, NULL, NULL,
                             &answer_to_connection, NULL, MHD_OPTION_END);
  if (NULL == daemon)
    return 1;

  (void) getchar ();

  MHD_stop_daemon (daemon);
  return 0;
}

Every request funnels through your callback; you decide what to do with the URL, method, and headers. MHD handles the protocol minutiae — keep-alive, chunked transfer encoding, digest auth, TLS via GnuTLS, and even the HTTP Upgrade flow for WebSockets (see the websocket.c example) — while you keep ownership of the application.

Strengths: the friendliest license of the trio for proprietary software (LGPL-2.1-or-later, with a dual-license clause for non-SSL builds per the COPYING file), superb protocol correctness, a documented GNU coding environment, and no opinion about your I/O architecture.

Costs: no built-in static file serving or routing — you write those. The callback API is more verbose than CivetWeb’s handler registration, and the project is conservative by design: features arrive slowly, which is precisely why it has been stable since 2001.

Licensing, Threading & Other Traps

1. License mismatch is the expensive mistake. Mongoose is GPLv2/commercial dual-licensed: if your product is proprietary and you do not buy a license, you cannot ship it. CivetWeb (MIT core) and libmicrohttpd (LGPL) both permit proprietary use — LGPL additionally requires that you allow users to replace the library (relink), which dynamic linking or provided object files satisfy in practice.
2. Threading model is a feature, not an implementation detail. Mongoose’s single-threaded event loop demands non-blocking handlers; CivetWeb’s threads let you write blocking handlers but cost RAM per connection; libmicrohttpd lets you pick per deployment. Match the model to your other I/O, not to the HTTP code.
3. TLS stack lock-in. Mongoose and CivetWeb let you choose mbedTLS/OpenSSL/wolfSSL; libmicrohttpd is GnuTLS. If your org standardizes on one crypto provider, verify support before committing — swapping later means re-testing every handshake path.
4. Static files are not free. CivetWeb serves a directory with one option (document_root); Mongoose needs a handler for static assets or its built-in file serving enabled; libmicrohttpd gives you nothing — you stream files yourself, including range requests if you want video seeking to work.
5. The name “Mongoose” is overloaded. The C library (cesanta/mongoose) shares its name with a JavaScript ODM for MongoDB and a bicycle brand. When searching for docs or filing bugs, always qualify: “Cesanta Mongoose” or “mongoose.ws”.
6. Port reuse and graceful restart. CivetWeb and MHD both support SO_REUSEPORT-style setups, but CivetWeb’s multi-threaded accepts can misbehave under aggressive restart loops if lingering connections hold the port. Test your supervisor’s restart policy early.
7. If you are comparing full web servers instead of libraries, see our nginx vs Caddy vs OpenResty guide — and for the JVM equivalent of this decision, our Jetty vs Netty vs Undertow vs Tomcat comparison covers embedded HTTP in Java. For WebSocket-specific libraries in C++, our websocketpp vs Beast vs IXWebSocket guide fills the gap when you need sockets beyond HTTP.

FAQ

What is an embedded HTTP server library? A C library that you link into your own program so it can serve HTTP requests without a separate web server process. Examples include Mongoose, CivetWeb, and GNU libmicrohttpd — all three are used inside firmware, desktop applications, and appliances to expose configuration UIs and REST APIs.

Can I use Mongoose in a commercial closed-source product? Only with a commercial license from Cesanta. The library is dual-licensed under GPLv2 and a paid commercial license — the LICENSE file states this explicitly. CivetWeb (MIT core) and libmicrohttpd (LGPL) are the usual choices for proprietary products without a licensing budget.

Which library is best for the ESP32? Mongoose is the standard answer: it is designed for microcontrollers, can use its own lightweight TCP/IP stack, and its single-file amalgamation compiles in ESP-IDF and Arduino projects. CivetWeb targets desktop/server-class systems and libmicrohttpd requires a POSIX or Windows environment.

Does libmicrohttpd support WebSockets? Yes — the official sources include a websocket.c example. MHD handles the HTTP Upgrade handshake; you then drive the socket through your own event loop. It is more plumbing than CivetWeb’s WebSocket handler, but it fits MHD’s philosophy of leaving I/O ownership to you.

How do these compare to running nginx inside a container? Embedded libraries win when the HTTP surface is small, the deployment is a single binary, or the host is a microcontroller; nginx wins on concurrency, static-file performance, and battle-tested TLS termination at scale. Many products do both: an embedded server for local config and a reverse proxy for public traffic.

Is CivetWeb still maintained in 2026? Yes — the repository received its latest push on August 1, 2026, and the project’s decade-long API stability is deliberate. Development is slower than Mongoose’s near-daily commits, but the project remains the most feature-complete permissively licensed option.

💰 想测试你的市场判断力？我用 Polymarket 做预测市场交易——这是全球最大的预测市场平台，从大选结果到技术监管时间线，什么都可以押注。和赌博不同，这是真正的信息市场：你懂的信息越多，胜率越高。我靠预测技术相关事件的走向已经赚了不少。用我的邀请链接注册：Polymarket.com