- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 4 critical, 3 high, 5 medium
- Registry
- pkg.go.dev
Advisories 13
- CVE-2026-119285Medium 5.9
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Affected: from 2.52.1, fixed in 2.52.3.
- CVE-2026-45045Medium 5.3
Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
Affected: fixed in 2.52.14.
- CVE-2026-42554Medium 5.3
Fiber: XSS in AutoFormat Content Negotiation
Affected: fixed in 2.52.13.
- CVE-2026-25882Medium 5.5
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Affected: fixed in 2.52.12.
- CVE-2025-66630Critical 9.2
Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Affected: fixed in 2.52.11.
- CVE-2025-54801High 8.7
Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Affected: fixed in 2.52.9.
- CVE-2025-48075High 7.7
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Affected: from 2.52.6, fixed in 2.52.7.
- CVE-2024-38513Critical 10.0
Fiber Session Middleware Token Injection Vulnerability
Affected: fixed in 2.52.5.
- CVE-2024-25124Critical 9.4
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Affected: fixed in 2.52.1.
- CVE-2023-45141High 8.6
CSRF Token Validation Vulnerability in fiber
Affected: fixed in 2.50.0.
- CVE-2023-45128Critical 10.0
CSRF Token Reuse Vulnerability in fiber
Affected: fixed in 2.50.0.
- CVE-2023-41338Medium 5.3
Vulnerability in Ctx.IsFromLocal() in gofiber
Affected: fixed in 2.49.2-0.20230906112033-b8c9ede6efa2; fixed in 2.49.2.
- CVE-2018-20744Unrated
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header…
Affected: from 2.0.0, fixed in 2.43.0.