Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/gofiber/fiber/v3

8 known vulnerabilities (2 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 6 medium
Registry
pkg.go.dev

Advisories 8

  • CVE-2026-44332Medium 5.3

    Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

    Affected: fixed in 3.3.0.

  • CVE-2026-53624Medium 4.8

    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

    Affected: fixed in 3.4.0.

  • CVE-2026-45045Medium 5.3

    Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

    Affected: fixed in 3.3.0.

  • CVE-2026-42554Medium 5.3

    Fiber: XSS in AutoFormat Content Negotiation

    Affected: fixed in 3.2.0.

  • CVE-2026-30246Medium 6.5

    github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters

    Affected: fixed in 3.2.0.

  • Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation

    Affected: fixed in 3.1.0.

  • Fiber has an Arbitrary File Read in Static Middleware on Windows

    Affected: fixed in 3.1.0.

  • CVE-2026-25882Medium 5.5

    Fiber has a Denial of Service Vulnerability via Route Parameter Overflow

    Affected: fixed in 3.1.0.