FI
Product
fiber
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 7Low 0
Watch
Add fiber to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-30246 | 6.5 | May 5 | github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters Affected: >= v3.0.0-beta.2, < 3.1.0 |
| CVE-2026-42554 | 6.1 | May 11 | Fiber: XSS in AutoFormat Content Negotiation Affected: < 2.52.13; >= 3.0.0-beta.2, < 3.1.0 |
| CVE-2020-15111 | 5.4 | Jul 20 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection… Affected: before 1.12.6 |
| CVE-2026-44332 | 5.3 | Jul 8 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer Affected: < 3.3.0 |
| CVE-2026-45045 | 5.3 | Jul 8 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward Affected: >= 3.0.0-beta.2, < 3.3.0; < 2.52.14 |
| CVE-2023-41338 | 5.3 | Sep 8 | Fiber is an Express inspired web framework built in the go language Affected: before 2.49.2 |
| CVE-2026-53624 | 4.8 | Jul 8 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol check Affected: < 3.4.0 |
Showing 7