Skip to content
OpenAdvisories

Package · Go

github.com/gofiber/fiber

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-53624

    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

    Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https…

    gofiber fiber github.com/gofiber/fiber/v3 github.com/gofiber/fiber Ubuntu Go
  • Medium 5.3
    CVE-2023-41338

    Vulnerability in Ctx.IsFromLocal() in gofiber

    Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to loca…

    gofiber fiber github.com/gofiber/fiber/v2 github.com/gofiber/fiber Go
  • Medium 4.2
    CVE-2020-15111

    CRLF vulnerability in Fiber

    In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link …

    gofiber fiber github.com/gofiber/fiber Go