gofiber fiber
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-119285 | >= 2.52.1, < 2.52.3 | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-44332 | < 3.3.0 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-53624 | < 3.4.0 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol check | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-45045 | >= 3.0.0-beta.2, < 3.3.0 ; < 2.52.14 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-42554 | < 2.52.13 ; >= 3.0.0-beta.2, < 3.1.0 | Fiber: XSS in AutoFormat Content Negotiation | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-30246 | >= v3.0.0-beta.2, < 3.1.0 | github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-25899 | >= 3.0.0, < 3.1.0 | Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation | HIGH 7.5 | 0.4 % | ||
| CVE-2026-25891 | >= 3.0.0, < 3.1.0 | Fiber has an Arbitrary File Read in Static Middleware on Windows | HIGH 7.7 | 0.7 % | ||
| CVE-2026-25882 | >= 2.0.0, < 2.52.12 ; >= 3.0.0, < 3.1.0 | Fiber has a Denial of Service Vulnerability via Route Parameter Overflow | MEDIUM 5.5 | 0.7 % | ||
| CVE-2025-66630 | < 2.52.11 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure | CRITICAL 9.2 | 0.5 % | ||
| CVE-2025-54801 | < 2.52.9 | Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder | HIGH 8.7 | 0.4 % | ||
| CVE-2025-48075 | >= 2.52.6, < 2.52.7 | Fiber panics when fiber.Ctx.BodyParser parses invalid range index | HIGH 7.7 | 0.5 % | ||
| CVE-2024-38513 | < 2.52.5 | Fiber Session Middleware Token Injection Vulnerability | CRITICAL 10.0 | 0.7 % | ||
| CVE-2024-25124 | < 2.52.1 | Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials | CRITICAL 9.8 | 0.7 % | ||
| CVE-2023-45141 | < 2.50.0 | CSRF Token Validation Vulnerability in fiber | HIGH 8.8 | 0.3 % | ||
| CVE-2023-45128 | < 2.50.0 | CSRF Token Reuse Vulnerability in fiber | CRITICAL 10.0 | 0.4 % | ||
| CVE-2023-41338 | < 2.49.2 | Vulnerability in Ctx.IsFromLocal() in gofiber | MEDIUM 5.3 | 0.7 % | ||
| CVE-2020-15111 | < 1.12.6 | CRLF vulnerability in Fiber | MEDIUM 5.4 | 0.9 % |