Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

fiber — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in fiber, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting the Fiber product. It collects entries by weakness type, vendor, and product, covering vulnerabilities disclosed over the last five years. Readers can use this resource to track the vendor's advisory history, analyze the prevalence of specific weakness classes, and review the cumulative vulnerability history associated with this software. The data is organized to support security assessments, patch planning, and risk analysis for organizations deploying Fiber in their infrastructure. No individual CVE identifiers are listed; instead, the focus is on pattern recognition across the vulnerability dataset.

Vendor: gofiber

CVE ID Title CVSS Severity Published
CVE-2026-44332 Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer CWE-203 5.3 Medium 2026-07-08
CVE-2026-53624 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check CWE-319 4.8 Medium 2026-07-08
CVE-2026-45045 Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward CWE-290 5.3 Medium 2026-07-08
CVE-2026-42554 Fiber: XSS in AutoFormat Content Negotiation CWE-79 - - 2026-05-11
CVE-2026-30246 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters CWE-436 6.5 Medium 2026-05-05
CVE-2026-25899 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation CWE-789 7.5 High 2026-02-24
CVE-2026-25891 Fiber has an Arbitrary File Read in Static Middleware on Windows CWE-22 7.5AI High AI 2026-02-24
CVE-2026-25882 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CWE-129 7.5AI High AI 2026-02-24
CVE-2025-66630 Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure CWE-338 9.1AI Critical AI 2026-02-09
CVE-2025-54801 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder CWE-789 7.5AI High AI 2025-08-05
CVE-2025-48075 Fiber panics when fiber.Ctx.BodyParser parses invalid range index CWE-129 7.5AI High AI 2025-05-22
CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability CWE-384 10.0 Critical 2024-07-01
CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CWE-346 9.4 Critical 2024-02-21
CVE-2023-45141 CSRF Token Validation Vulnerability in fiber CWE-352 8.6 High 2023-10-16
CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber CWE-20 10.0 Critical 2023-10-16
CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber CWE-670 5.3 Medium 2023-09-08
CVE-2020-15111 CRLF vulnerability in Fiber CWE-74 4.2 Medium 2020-07-20

All 17 known CVE vulnerabilities affecting fiber with full Chinese analysis, references, and POCs where available.