HTTP Just Got Its First New Method in 15 Years: The Complete 2026 Guide to QUERY (RFC 10008) and the Real State of HTTP/3

Quick test: when was the last time HTTP got a genuinely new method?

Not a new version. Not a new header. A brand-new verb, sitting alongside GET, POST, PUT, PATCH, and DELETE.

If you guessed 2010 — PATCH, RFC 5789 — you're right. And you're also more informed than most developers right now, because in June 2026, the IETF quietly published RFC 10008, defining a new HTTP method called QUERY. It's a bigger deal than it sounds, and almost nobody outside the standards world has caught up to it yet.

This guide covers exactly what QUERY is, why it exists, how to use it with real code today, and — because no HTTP guide in 2026 is complete without addressing it — the surprisingly different reality of where HTTP/3 actually stands this year compared to what most articles still claim.

The Problem Every Developer Has Quietly Worked Around

You've done this. Everyone has.

You needed to build a search endpoint. The filters got complicated — categories, price ranges, date ranges, sort orders, pagination, maybe a nested JSON blob someone base64-encoded and jammed into a query parameter because there was nowhere else to put it. You had exactly two imperfect options:

Option A: Use GET.

GET /products?filter={"and":[{"category":"laptops"},{"price":{"gte":500,"lte":1500}}]}&sort=price_asc

Semantically correct — a GET is a safe, read-only, cacheable, retryable request. But it falls apart fast:

• Nobody knows the real URL length limit ahead of time, because the request passes through multiple uncoordinated proxies, gateways, and load balancers — RFC 9110 only recommends 8,000 octets as a floor, not a ceiling.

• Structured data (nested filters, arrays, arbitrary JSON) is awkward and expensive to cram into a URL-safe string.

• URLs get logged, cached in browser history, and saved in bookmarks — not where you want sensitive filter criteria sitting.

Option B: Use POST.

POST /products/search
Content-Type: application/json
{ "category": "laptops", "price": { "min": 500, "max": 1500 } }

This solves the size and structure problem. But now you've told every cache, proxy, and client library that this is an unsafe, non-idempotent operation — even though it's just a read. No automatic retries. No native caching. No safe-to-repeat guarantee. You're doing a read operation with write-operation semantics.

This mismatch has existed since HTTP's earliest days. RFC 10008 finally closes it.

Meet QUERY: The Method Built for Exactly This Gap

QUERY takes the part of POST that makes it useful (a request body) and combines it with the part of GET that makes it safe (safe and idempotent semantics). Per the IANA HTTP Method Registry, it's now formally registered as both safe and idempotent — the same category as GET, HEAD, and OPTIONS — while still allowing a full request body like POST.

QUERY /products/search HTTP/1.1
Host: api.example.com
Content-Type: application/json
Accept: application/json

{
  "category": "laptops",
  "price": { "min": 500, "max": 1500 },
  "sort": [{ "field": "price", "direction": "asc" }]
}

That's it. Same body-based flexibility as POST, but the client, any cache, and any proxy in between now know — at the protocol level, not by convention — that this request is safe to retry automatically and safe to cache.

GET vs. POST vs. QUERY — Side by Side

The Accept-Query Header: How Servers Advertise Support

RFC 10008 also registers a new response header, Accept-Query, so a resource can tell clients which query formats it understands — because QUERY is intentionally format-agnostic. The RFC doesn't define a query language; it defines the transport. Your endpoint might accept JSON filters, SQL-like expressions, JSONPath, GraphQL-style documents, or something proprietary.

HTTP/1.1 200 OK
Content-Type: application/json
Accept-Query: "application/json", "application/sql"

A client can discover this in advance with a HEAD or OPTIONS request, instead of guessing and getting a 415 back.

Real Code: Handling QUERY Today

Because most HTTP libraries already treat methods as arbitrary strings under the hood, you can start experimenting with QUERY right now, even before frameworks add first-class support.

Server (Node.js / Express):

js

import express from 'express';
const app = express();
app.use(express.json());

// Express doesn't have app.query() yet — route it manually for now.
app.use((req, res, next) => {
  if (req.method === 'QUERY' && req.path === '/products/search') {
    return handleProductQuery(req, res);
  }
  next();
});

function handleProductQuery(req, res) {
  if (!req.is('application/json')) {
    return res
      .status(415) // Unsupported Media Type
      .set('Accept-Query', '"application/json"')
      .json({ error: 'This endpoint only accepts application/json queries' });
  }

  const { category, price, sort } = req.body;

  let results;
  try {
    results = runProductSearch({ category, price, sort });
  } catch (err) {
    // Valid JSON, but the query itself doesn't make sense
    // (e.g. an unknown field) → 422, not 400.
    return res.status(422).json({ error: 'Unprocessable query', detail: err.message });
  }

  res
    .status(200)
    .set('Accept-Query', '"application/json"')
    .set('Vary', 'Accept-Query, Content-Type')
    .json(results);
}

Client (fetch):

js

const response = await fetch('https://api.example.com/products/search', {
  method: 'QUERY', // not GET, not POST
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    category: 'laptops',
    price: { min: 500, max: 1500 },
    sort: [{ field: 'price', direction: 'asc' }]
  })
});

const products = await response.json();

A few things worth knowing before you ship this:

• CORS preflight is unavoidable. QUERY is not on the CORS-safelisted method list, so every cross-origin browser call triggers an OPTIONS preflight first. Budget for that extra round trip on latency-sensitive paths.

• Status codes matter more here than with GET. The RFC's guidance: 400 for malformed content, 415 when the Content-Type isn't one the resource accepts (pair it with Accept-Query in the response), 422 when the format is valid but the query itself can't be processed (e.g., filtering on a field that doesn't exist), and 406 when you can't produce a response in the format the client asked for via Accept.

• Caching is real, but not free. Unlike GET, where the URL alone is the cache key, a QUERY response's cache key has to incorporate the full request body and its Content-Type. Caches are allowed to normalize semantically-insignificant differences (key ordering, whitespace) to improve hit rates, but that logic has to exactly match how your endpoint interprets the query — get it wrong and you'll serve stale or incorrect results to the wrong request.

• Redirects behave differently than POST. The awkward "redirect a POST as a GET" downgrade behavior on 301/302 doesn't apply to QUERY — it stays QUERY when following a redirect, which is a cleaner, more predictable rule.

• You can hand clients a shortcut. If your server can assign a stable path to a specific query's result, return it via Location (repeat the exact query later without resending the body) or Content-Location (fetch this specific result again via a plain GET) — letting clients fall back to cheap, conditional GETs with ETag/If-Modified-Since instead of re-sending the full query every time.

Should You Actually Use It Right Now?

Be realistic about where the ecosystem is. The spec is finalized and final — but a finalized RFC and a fully supported ecosystem are two different things.

• Backend-to-backend and internal APIs: Safe to start today. Most modern HTTP clients (Go's standard library, Python's httpx, Rust's reqwest, Node's fetch) already let you send arbitrary method strings, so nothing stops you from using QUERY between your own services right now.

• Public, browser-facing APIs: Move gradually. Keep your existing POST /search endpoint working, add QUERY alongside it, and advertise support via Accept-Query so clients can migrate as their tooling catches up.

• Infrastructure: This is the real bottleneck. Older proxies, API gateways, and firewalls with method allow-lists may reject an unfamiliar verb outright until vendors patch their products. Notably, RFC 10008 was co-authored by engineers from Cloudflare and Akamai — a strong signal that CDN-level support may land faster than framework-level support.

The pattern will likely mirror PATCH: standardized quickly, adopted slowly, and eventually just... normal.

Now, About HTTP/3 — Here's What Most 2026 Articles Get Wrong

Nearly every "HTTP in 2026" post repeats the same claim: HTTP/3 adoption keeps climbing, so migrate now. The actual traffic data tells a more interesting story.

According to Cloudflare Radar's own public measurements, HTTP/3 peaked at roughly 28% of global web traffic back in May 2023 — and by mid-2026, it's sitting around 21%, essentially flat to slightly down over the last several months. Meanwhile, HTTP/2 has grown to over 51% of global traffic and is the actual dominant protocol of 2026, and legacy HTTP/1.x still holds a sticky ~27–28% share, kept alive by bot traffic, server-to-server API calls, and legacy clients that aren't going anywhere soon.

That's not the story you'd expect from "HTTP/3 is the future" headlines.

Why the Plateau? It's Physics, Not Neglect

Browser support isn't the blocker — Chrome, Firefox, Safari, and Edge have all supported HTTP/3 natively for a while now. The real explanation is more technical and genuinely interesting: research presented at the 2024 ACM Web Conference ("QUIC is not Quick Enough over Fast Internet") found that QUIC can lose a significant chunk of throughput — in some tests up to 45% — compared to HTTP/2 on connections above roughly 500 Mbps. QUIC's packet processing happens in user space rather than the kernel, which adds CPU overhead that barely matters on a slow or lossy connection but becomes the actual bottleneck once the network itself is no longer the limiting factor.

Fiber and high-speed broadband have crossed that threshold across a lot of developed markets in 2026 — so for a meaningful slice of users, HTTP/3 has quietly gone from "faster" to "not worth the CPU cost," which is exactly why adoption has stalled rather than continuing its earlier climb.

Where HTTP/3 Still Genuinely Wins

This isn't an argument against HTTP/3 — it's an argument for using it where it actually helps:

• Mobile users switching networks — QUIC's connection migration means moving from Wi-Fi to 5G to Wi-Fi again doesn't force a full reconnect.

• High-latency or lossy connections — QUIC's independent per-stream loss recovery avoids the head-of-line blocking that TCP (and therefore HTTP/2) suffers from when a single packet drops.

• Emerging markets and unreliable networks — where connection drops and packet loss are the norm, not the exception.

If most of your users are on fast, stable, fixed broadband, enabling HTTP/3 might not move your Core Web Vitals much — and could even add marginal overhead. If a meaningful share of your traffic is mobile or high-latency, it's still very much worth having. Test with real user monitoring rather than assuming either direction.

Quick Refresher: How HTTP Actually Got Here

Worth knowing the lineage, since it explains why QUERY and HTTP/3 both exist:

• HTTP/1.0 (1996): One TCP connection per request. Loading 50 assets meant 50 separate connections. Painfully slow by design.

• HTTP/1.1: Persistent connections, keep-alive, host headers, better caching. A single connection could now serve multiple sequential requests.

• HTTP/2: Multiplexing let multiple requests share one connection simultaneously, plus header compression and a binary framing format. Huge win — but still built on TCP.

• HTTP/3: Solves the problem HTTP/2 exposed rather than solved — TCP's head-of-line blocking, where one lost packet stalls every stream sharing that connection, regardless of which request it belongs to. HTTP/3 replaces TCP with QUIC, a transport protocol built on UDP that bundles in encryption and handles loss recovery per-stream instead of per-connection.

Modern HTTP's actual foundational specs are RFC 9110 (HTTP Semantics — the versionless rules shared across every version), RFC 9111 (Caching), RFC 9112 (HTTP/1.1), RFC 9113 (HTTP/2), and RFC 9114 (HTTP/3) — all published together back in June 2022, consolidating and fixing more than 475 issues from the older, messier RFC 7230–7235 series. They're the stable foundation, not a 2026 novelty. RFC 10008 is what's actually new this year — a sixth document extending that same family.

HTTP Methods Cheat Sheet (Now Including QUERY)

Status Codes Every Developer Should Still Know

• 2xx — 200 OK, 201 Created, 204 No Content

• 3xx — 301/308 permanent redirect, 302/307 temporary redirect, 304 Not Modified (cache still valid)

• 4xx — 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 415 Unsupported Media Type, 422 Unprocessable Content, 429 Too Many Requests

• 5xx — 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

Caching, Compression, and Security — Still the Fundamentals

None of the above matters if the basics are missing:

• Caching: Use Cache-Control, ETag, and Last-Modified deliberately — good caching cuts server load, speeds up repeat visits, and helps Core Web Vitals.

• Compression: Brotli and Gzip routinely shrink payloads from megabytes to a fraction of that size — don't ship uncompressed responses in 2026.

• Security: HTTPS everywhere (TLS 1.3 adoption is now above 75% among top sites), HSTS enabled, secure and SameSite cookies, a real Content-Security-Policy, and no mixed content.

What This Means for API Design Going Forward

If you're designing or refactoring an API in the second half of 2026, here's the practical takeaway:

1. Stop overloading POST for reads. If an endpoint is doing a read with complex parameters, QUERY is now the semantically correct tool — start planning for it even if you ship it behind your existing POST endpoint first.

2. Don't assume HTTP/3 is automatically the right call. Check your actual traffic mix — mobile and high-latency users benefit; users on fast fixed connections may not.

3. Get comfortable with the new method registry entry. QUERY will show up in framework changelogs, API gateway docs, and CDN release notes over the next year — knowing it now puts you ahead of most of the industry.

Frequently Asked Questions

What is the HTTP QUERY method? A new HTTP method, standardized in RFC 10008 (June 2026), that lets clients send a request body — like POST — while being explicitly safe and idempotent — like GET. It's designed for complex, read-only operations such as search and reporting.

Is QUERY the same as POST /search? Functionally similar, but semantically different. A POST /search gives no protocol-level guarantee that the operation is safe or cacheable — clients and caches can't tell it apart from a request that changes data. QUERY makes that guarantee explicit, enabling automatic retries and native HTTP caching.

Can I use QUERY in production today? For internal and backend-to-backend APIs, yes — most HTTP client libraries already support arbitrary methods. For public, browser-facing APIs, roll it out gradually alongside your existing endpoint, since some proxies, gateways, and older infrastructure may not recognize it yet.

Does QUERY replace GET or POST? No. GET remains correct for simple, URL-expressible lookups. POST remains correct for anything that creates or changes state. QUERY fills the specific gap between them: safe, idempotent reads that need a request body.

Is HTTP/3 still worth enabling in 2026? Yes, but it's not universally faster anymore. It offers real, measurable benefits on mobile and high-latency or lossy networks. On fast, stable, fixed connections, the benefit shrinks and can occasionally reverse due to QUIC's processing overhead. Check your real user monitoring data rather than assuming.

Do I need to rewrite my application to support HTTP/3? Usually not — in most setups, enabling HTTP/3 is a CDN or infrastructure-level configuration change, not an application rewrite.

Final Thoughts

For over a decade, HTTP's method vocabulary didn't change — and most developers stopped expecting it to. RFC 10008 quietly breaks that streak. QUERY isn't a flashy addition, but it fixes a real, everyday problem that nearly every API developer has hit and worked around with an imperfect compromise.

Meanwhile, the more well-known story — HTTP/3 sweeping the web — turns out to be more nuanced than the headlines suggest, plateauing rather than accelerating, for reasons rooted in real network physics rather than sluggish adoption.

Understanding both of these — the brand-new method nobody's talking about yet, and the popular narrative that the data doesn't fully support — is exactly the kind of grounded, current knowledge that separates developers who repeat what they read from developers who actually understand the protocol moving every byte across the internet.

— Manoj Kumar Mandal Full Stack Developer | AI Engineer https://manojmandal.com