MEDIUM5.3Go
GHSA-3q5p-3558-364f· CVE-2023-41338, GO-2023-2052Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Modified: 9/10/2026
package
Go/github.com/gofiber/fiber/v2
pkg:go/github.com/gofiber/fiber/v2
CRITICALGo
GHSA-68rr-p4fp-j59v· CVE-2025-66630, GO-2026-4471Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-927h-x4qj-r242· CVE-2018-20744, GO-2023-1792github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
Modified: 5/20/2024
CRITICAL9.6Go
GHSA-94w9-97p3-p368· CVE-2023-45128, GO-2023-2115CSRF Token Reuse Vulnerability
Modified: 11/8/2023
CRITICAL10.0Go
GHSA-98j2-3j3p-fw2v· CVE-2024-38513, GO-2024-2959Session Middleware Token Injection Vulnerability
Modified: 9/10/2026
CRITICAL9.4Go
GHSA-fmg4-x8pw-hjhg· CVE-2024-25124, GO-2024-2574Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-gcfq-8gqf-4876· CVE-2026-45045, GO-2026-5887GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
Modified: 9/10/2026
HIGHGo
GHSA-hg3g-gphw-5hhm· CVE-2025-48075, GO-2025-3706Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Modified: 9/10/2026
MEDIUMGo
GHSA-mrq8-rjmw-wpq3· CVE-2026-25882, GO-2026-4543Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Modified: 9/10/2026
HIGH8.8Go
GHSA-mv73-f69x-444p· CVE-2023-45141, GO-2023-2116Go Fiber CSRF Token Validation Vulnerability
Modified: 9/10/2026
MEDIUMGo
GHSA-qjv7-627w-8qjv· CVE-2026-42554, GO-2026-5585Fiber vulnerable to XSS in AutoFormat Content Negotiation
Modified: 9/10/2026
HIGHGo
GHSA-qx2q-88mx-vhg7· CVE-2025-54801, GO-2025-3845Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder
Modified: 9/10/2026
—Go
GO-2023-2052· CVE-2023-41338, GHSA-3q5p-3558-364fIsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2
Modified: 5/20/2024
—Go
GO-2023-2115· CVE-2023-45128, GHSA-94w9-97p3-p368CSRF token reuse vulnerability in github.com/gofiber/fiber/v2
Modified: 5/20/2024
—Go
GO-2023-2116· CVE-2023-45141, GHSA-mv73-f69x-444pCSRF token validation vulnerability in github.com/gofiber/fiber/v2
Modified: 5/20/2024
—Go
GO-2024-2574· CVE-2024-25124, GHSA-fmg4-x8pw-hjhgInsecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2
Modified: 5/20/2024
—Go
GO-2024-2959· CVE-2024-38513, GHSA-98j2-3j3p-fw2vSession Middleware Token Injection Vulnerability in github.com/gofiber/fiber
Modified: 3/3/2026
—Go
GO-2025-3706· CVE-2025-48075, GHSA-hg3g-gphw-5hhmFiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Modified: 2/4/2026
—Go
GO-2025-3845· CVE-2025-54801, GHSA-qx2q-88mx-vhg7Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder in github.com/gofiber/fiber
Modified: 2/4/2026
—Go
GO-2026-4471· CVE-2025-66630, GHSA-68rr-p4fp-j59vFiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in github.com/gofiber/fiber
Modified: 2/19/2026
—Go
GO-2026-4543· CVE-2026-25882, GHSA-mrq8-rjmw-wpq3Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in github.com/gofiber/fiber
Modified: 2/26/2026
—Go
GO-2026-5585· CVE-2026-42554, GHSA-qjv7-627w-8qjvFiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
Modified: 7/24/2026