gofiber fiber vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20233
3. 20242
4. 20252
5. 202610

Newest CVEs

• CVE-2026-119285

  Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

  gofiber · fiber

  Medium5.9
• CVE-2026-44332

  Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

  gofiber · fiber

  Medium5.3
• CVE-2026-53624

  Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

  gofiber · fiber

  Medium4.8
• CVE-2026-45045

  Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

  gofiber · fiber

  Medium5.3
• CVE-2026-42554

  Fiber: XSS in AutoFormat Content Negotiation

  gofiber · fiber

  Medium5.3
• CVE-2026-30246

  github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters

  gofiber · fiber

  Medium6.5
• CVE-2026-25899

  Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation

  gofiber · fiber

  High7.5
• CVE-2026-25891

  Fiber has an Arbitrary File Read in Static Middleware on Windows

  gofiber · fiber

  High7.7
• CVE-2026-25882

  Fiber has a Denial of Service Vulnerability via Route Parameter Overflow

  gofiber · fiber

  Medium5.5
• CVE-2025-66630

  Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

  gofiber · fiber

  Critical9.2