GO
Vendor
gofiber
19
CVEs
0
On KEV
0
New 30D
Products
FI9.8
fiber
gofiber
17 CVEs0 on KEV0 new
DJ6.1
Django
Gofiber
1 CVEs0 on KEV0 new
UT9.8
utils
gofiber
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44332 | FI fiber gofiber | 5.3 | Jul 8 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer |
| CVE-2026-53624 | FI fiber gofiber | 4.8 | Jul 8 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol check |
| CVE-2026-45045 | FI fiber gofiber | 5.3 | Jul 8 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward |
| CVE-2026-42554 | FI fiber gofiber | 6.1 | May 11 | Fiber: XSS in AutoFormat Content Negotiation |
| CVE-2026-30246 | FI fiber gofiber | 6.5 | May 5 | github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters |
| CVE-2026-25899 | FI fiber gofiber | 7.5 | Feb 24 | Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation |
| CVE-2026-25891 | FI fiber gofiber | 7.5 | Feb 24 | Fiber has an Arbitrary File Read in Static Middleware on Windows |
| CVE-2026-25882 | FI fiber gofiber | 7.5 | Feb 24 | Fiber has a Denial of Service Vulnerability via Route Parameter Overflow |
| CVE-2025-66630 | FI fiber gofiber | 9.4 | Feb 9 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure |
| CVE-2025-66565 | UT utils gofiber | 9.8 | Dec 9 | Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values |
| CVE-2025-54801 | FI fiber gofiber | 7.5 | Aug 5 | Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder |
| CVE-2025-48075 | FI fiber gofiber | 7.5 | May 22 | Fiber panics when fiber.Ctx.BodyParser parses invalid range index |
| CVE-2024-38513 | FI Fiber Gofiber | 9.8 | Jul 1 | Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above |
| CVE-2024-25124 | FI Fiber Gofiber | 9.8 | Feb 21 | Fiber is a web framework written in go |
| CVE-2024-22199 | DJ Django Gofiber | 6.1 | Jan 11 | This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface |
| CVE-2023-45141 | FI Fiber Gofiber | 8.8 | Oct 16 | Fiber is an express inspired web framework written in Go |
| CVE-2023-45128 | FI Fiber Gofiber | 8.8 | Oct 16 | Fiber is an express inspired web framework written in Go |
| CVE-2023-41338 | FI Fiber Gofiber | 5.3 | Sep 8 | Fiber is an Express inspired web framework built in the go language |
| CVE-2020-15111 | FI Fiber Gofiber | 5.4 | Jul 20 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection… |