HIGH7.5Go
GHSA-2mr3-m5q5-wgp6· CVE-2026-25899, GO-2026-4534Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Modified: 2/27/2026
package
Go/github.com/gofiber/fiber/v3
pkg:go/github.com/gofiber/fiber/v3
MEDIUM6.5Go
GHSA-35hp-hqmv-8qg8· CVE-2026-30246, GO-2026-5069Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
Modified: 7/24/2026
MEDIUM5.3Go
GHSA-g5vh-55hw-rxm8· CVE-2026-44332, GO-2026-5886GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
Modified: 7/24/2026
MEDIUM5.3Go
GHSA-gcfq-8gqf-4876· CVE-2026-45045, GO-2026-5887GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
Modified: 9/10/2026
HIGHGo
GHSA-m3c2-496v-cw3v· CVE-2026-25891, GO-2026-4540Fiber has an Arbitrary File Read in Static Middleware on Windows
Modified: 2/27/2026
MEDIUMGo
GHSA-mrq8-rjmw-wpq3· CVE-2026-25882, GO-2026-4543Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Modified: 9/10/2026
MEDIUMGo
GHSA-qjv7-627w-8qjv· CVE-2026-42554, GO-2026-5585Fiber vulnerable to XSS in AutoFormat Content Negotiation
Modified: 9/10/2026
—Go
GO-2026-4534· CVE-2026-25899, GHSA-2mr3-m5q5-wgp6Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3
Modified: 2/26/2026
—Go
GO-2026-4540· CVE-2026-25891, GHSA-m3c2-496v-cw3vFiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
Modified: 2/26/2026
—Go
GO-2026-4543· CVE-2026-25882, GHSA-mrq8-rjmw-wpq3Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in github.com/gofiber/fiber
Modified: 2/26/2026
—Go
GO-2026-5069· CVE-2026-30246, GHSA-35hp-hqmv-8qg8Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber
Modified: 7/24/2026
—Go
GO-2026-5585· CVE-2026-42554, GHSA-qjv7-627w-8qjvFiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
Modified: 7/24/2026
—Go
GO-2026-5886· CVE-2026-44332, GHSA-g5vh-55hw-rxm8GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
Modified: 7/24/2026
—Go
GO-2026-5887· CVE-2026-45045, GHSA-gcfq-8gqf-4876GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber
Modified: 7/24/2026
—Go
GO-2026-5912· CVE-2026-53624, GHSA-gv83-gqw6-9j2cGoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber
Modified: 7/24/2026