diff --git a/SECURITY.md b/SECURITY.md
index ee702f9fde..46de8f4f8b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -30,7 +30,7 @@ Support for OpenSSL is only provided for the Netty transport via [netty-tcnative
 
 ### OpenSSL: Dynamic vs Static (which to use?)
 
-As of version `1.1.33.Fork13`, netty-tcnative provides two options for usage: statically or dynamically linked. For simplification of initial setup,
+As of version `1.1.33.Fork14`, netty-tcnative provides two options for usage: statically or dynamically linked. For simplification of initial setup,
 we recommend that users first look at `netty-tcnative-boringssl-static`, which is statically linked against BoringSSL and Apache APR. Using this artifact requires no extra installation and guarantees that ALPN and the ciphers required for
 HTTP/2 are available.
 
@@ -60,7 +60,7 @@ In Maven, you can use the [os-maven-plugin](https://github.com/trustin/os-maven-
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>1.1.33.Fork13</version>
+      <version>1.1.33.Fork14</version>
       <classifier>${os.detected.classifier}</classifier>
     </dependency>
   </dependencies>
@@ -96,7 +96,7 @@ buildscript {
 apply plugin: "com.google.osdetector"
 
 dependencies {
-    compile 'io.netty:netty-tcnative-boringssl-static:1.1.33.Fork13:' + osdetector.classifier
+    compile 'io.netty:netty-tcnative-boringssl-static:1.1.33.Fork14:' + osdetector.classifier
 }
 ```
 
@@ -131,7 +131,7 @@ In Maven, you can use the [os-maven-plugin](https://github.com/trustin/os-maven-
     <dependency>
       <groupId>io.netty</groupId>
       <artifactId>netty-tcnative</artifactId>
-      <version>1.1.33.Fork13</version>
+      <version>1.1.33.Fork14</version>
       <classifier>${tcnative.classifier}</classifier>
     </dependency>
   </dependencies>
@@ -199,7 +199,7 @@ if (osdetector.os == "linux" && osdetector.release.isLike("fedora")) {
 }
 
 dependencies {
-    compile 'io.netty:netty-tcnative:1.1.33.Fork13:' + tcnative_classifier
+    compile 'io.netty:netty-tcnative:1.1.33.Fork14:' + tcnative_classifier
 }
 ```
 
diff --git a/build.gradle b/build.gradle
index 8f36af8473..eac869c2cf 100644
--- a/build.gradle
+++ b/build.gradle
@@ -136,9 +136,9 @@ subprojects {
                 protobuf_nano: "com.google.protobuf.nano:protobuf-javanano:${protobufNanoVersion}",
                 protobuf_plugin: 'com.google.protobuf:protobuf-gradle-plugin:0.7.4',
 
-                netty: 'io.netty:netty-codec-http2:4.1.0.CR1',
-                netty_epoll: 'io.netty:netty-transport-native-epoll:4.1.0.CR1' + epoll_suffix,
-                netty_tcnative: 'io.netty:netty-tcnative-boringssl-static:1.1.33.Fork13:' + osdetector.classifier,
+                netty: 'io.netty:netty-codec-http2:4.1.0.CR3',
+                netty_epoll: 'io.netty:netty-transport-native-epoll:4.1.0.CR3' + epoll_suffix,
+                netty_tcnative: 'io.netty:netty-tcnative-boringssl-static:1.1.33.Fork14:' + osdetector.classifier,
 
                 // Test dependencies.
                 junit: 'junit:junit:4.11',
diff --git a/netty/src/main/java/io/grpc/netty/NettyClientHandler.java b/netty/src/main/java/io/grpc/netty/NettyClientHandler.java
index 5e82ead48a..47c1c2fd0a 100644
--- a/netty/src/main/java/io/grpc/netty/NettyClientHandler.java
+++ b/netty/src/main/java/io/grpc/netty/NettyClientHandler.java
@@ -114,7 +114,6 @@ class NettyClientHandler extends AbstractNettyHandler {
   private Http2Ping ping;
   private Status goAwayStatus;
   private Throwable goAwayStatusThrowable;
-  private int nextStreamId;
 
   static NettyClientHandler newHandler(ManagedClientTransport.Listener listener,
                                        int flowControlWindow, int maxHeaderListSize,
@@ -185,7 +184,6 @@ class NettyClientHandler extends AbstractNettyHandler {
 
     Http2Connection connection = encoder.connection();
     streamKey = connection.newKey();
-    nextStreamId = connection.local().nextStreamId();
     connection.addListener(new Http2ConnectionAdapter() {
       @Override
       public void onGoAwayReceived(int lastStreamId, long errorCode, ByteBuf debugData) {
@@ -336,7 +334,7 @@ class NettyClientHandler extends AbstractNettyHandler {
     // Get the stream ID for the new stream.
     final int streamId;
     try {
-      streamId = getAndIncrementNextStreamId();
+      streamId = incrementAndGetNextStreamId();
     } catch (StatusException e) {
       // Stream IDs have been exhausted for this connection. Fail the promise immediately.
       promise.setFailure(e);
@@ -531,16 +529,14 @@ class NettyClientHandler extends AbstractNettyHandler {
     return stream == null ? null : (NettyClientStream) stream.getProperty(streamKey);
   }
 
-  private int getAndIncrementNextStreamId() throws StatusException {
+  private int incrementAndGetNextStreamId() throws StatusException {
+    int nextStreamId = connection().local().incrementAndGetNextStreamId();
     if (nextStreamId < 0) {
       logger.fine("Stream IDs have been exhausted for this connection. "
               + "Initiating graceful shutdown of the connection.");
       throw EXHAUSTED_STREAMS_STATUS.asException();
     }
-
-    int id = nextStreamId;
-    nextStreamId += 2;
-    return id;
+    return nextStreamId;
   }
 
   private Http2Stream requireHttp2Stream(int streamId) {