Skip to content
OpenAdvisories

Package · Ubuntu

golang-github-gofiber-fiber-v2

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.9
    CVE-2026-119285

    Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

    Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An applicat…

    gofiber fiber github.com/gofiber/fiber/v2 golang-github-gofiber-fiber Ubuntu Go
  • Medium 4.8
    CVE-2026-53624

    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

    Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https…

    gofiber fiber github.com/gofiber/fiber/v3 github.com/gofiber/fiber Ubuntu Go
  • Medium 5.3
    CVE-2026-45045

    Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

    Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-…

    gofiber fiber gatus github.com/gofiber/fiber/v2 Ubuntu Wolfi Go