—

GO-2026-6566

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio

Quick fix

GO-2026-6566 — github.com/fabiolb/fabio: upgrade to the fixed version with the command below.

go get github.com/fabiolb/fabio@v1.7.2

Details

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/fabiolb/fabio

Introduced in: 1.6.6Fixed in: 1.7.2

Fixgo get github.com/fabiolb/fabio@v1.7.2

References

https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-62987[ADVISORY]
https://github.com/fabiolb/fabio/commit/240526a8004077edad4fb96d25b382bfc3901357[FIX]
https://github.com/fabiolb/fabio/releases/tag/v1.7.2[WEB]