github.com/nsqio/nsq
This package has a good security score with no known vulnerabilities.
Community Reviews
Solid distributed messaging with minimal ceremony, great for Go projects
The consumer API with its `HandleMessage` interface is clean, and the automatic message requeuing on errors is a nice touch. Debugging is generally pleasant - error messages point you in the right direction, and the nsqd logs are verbose enough to trace message flow. One gotcha: the `Config` struct has many fields and some non-obvious defaults (like `MaxInFlight` affecting throughput significantly), so you'll want to read through configuration options carefully.
Community support is decent but not extensive - GitHub issues get responses, though sometimes slowly. Stack Overflow has limited content, so you'll rely more on reading the source code (which is well-organized) and official docs. The lack of complex abstractions means fewer "magic" behaviors to debug, which I appreciate.
Best for: Go projects needing straightforward distributed messaging without heavy framework overhead, especially when you value simplicity over complex routing features.
Avoid if: You need extensive community resources, complex message routing patterns, or want a more feature-rich system like RabbitMQ with its exchange types.
Solid distributed messaging with excellent operational characteristics
Observability is where NSQ really shines - the Stats() method exposes detailed metrics about message rates, in-flight counts, and connection health that integrate cleanly with Prometheus. The logging hooks are comprehensive, though you'll want to wire them to your structured logger immediately since the default output is verbose. Message requeuing semantics are explicit and predictable, which matters when debugging why messages are being retried.
The main gotcha is that MaxInFlight settings interact with concurrency in non-obvious ways - set it too low and you'll underutilize your handlers, too high and you risk overwhelming downstream services. The documentation could be clearer here. Also, graceful shutdown requires careful orchestration of StopChan and draining in-flight messages, but once you have the pattern down it's reliable.
Best for: High-throughput distributed systems needing reliable at-least-once delivery with strong operational visibility and automatic failover.
Avoid if: You need strict ordering guarantees, exactly-once semantics, or complex routing patterns better served by Kafka or RabbitMQ.
Solid messaging primitives but security requires manual hardening
TLS configuration exists but isn't enforced by default - you must explicitly configure it on both nsqd and clients. The authentication layer (nsqd --auth-http-address) delegates to an external HTTP endpoint, which is flexible but means you're responsible for implementing authn/authz logic correctly. There's no built-in mTLS or certificate validation helpers, so you're writing that boilerplate yourself.
Error messages can leak topology information (node addresses, channel names) which may be sensitive depending on your threat model. Input validation on topic/channel names is basic - the library accepts most strings, so you need application-level validation. The codebase is stable but CVE response has been slow historically, and dependency updates lag behind Go ecosystem best practices.
Best for: Internal service messaging where you control the network perimeter and can invest in proper TLS/auth setup.
Avoid if: You need secure-by-default messaging or lack resources to implement and maintain authentication infrastructure.
Sign in to write a review
Sign In