What’s Vulnerable › Products

gofiber fiber vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your gofiber fiber version is affected

Latest gofiber fiber vulnerabilities

• CVE-2026-53624 — Fiber: HSTS header never set in helmet middleware due to incorrect protocol check (CVSS 4.8)
• CVE-2026-45045 — Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward (CVSS 5.3)
• CVE-2026-44332 — Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer (CVSS 5.3)
• CVE-2026-42554 — Fiber: XSS in AutoFormat Content Negotiation (CVSS 6.1)
• CVE-2026-30246 — github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters (CVSS 6.5)
• CVE-2026-25899 — Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation (CVSS 7.5)
• CVE-2026-25891 — Fiber has an Arbitrary File Read in Static Middleware on Windows (CVSS 7.5)
• CVE-2026-25882 — Fiber has a Denial of Service Vulnerability via Route Parameter Overflow (CVSS 7.5)
• CVE-2025-66630 — Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure (CVSS 9.4)
• CVE-2025-54801 — Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder (CVSS 7.5)
• CVE-2025-48075 — Fiber panics when fiber.Ctx.BodyParser parses invalid range index (CVSS 7.5)
• CVE-2024-38513 — Fiber Session Middleware Token Injection Vulnerability (CVSS 9.8)
• CVE-2024-25124 — Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials (CVSS 9.8)
• CVE-2023-45141 — CSRF Token Validation Vulnerability in fiber (CVSS 8.8)
• CVE-2023-45128 — CSRF Token Reuse Vulnerability in fiber (CVSS 8.8)
• CVE-2023-41338 — Vulnerability in Ctx.IsFromLocal() in gofiber (CVSS 5.3)
• CVE-2020-15111 — CRLF vulnerability in Fiber (CVSS 5.4)