By vendor

Gofiber vulnerabilities

Known CVEs affecting Gofiber products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-44332MEDIUM 5.3

  Fiber, a popular Go web framework modeled after Express.js, contains a timing-based username enumeration vulnerability in its BasicAuth middleware. When authentication is attempted, the framework's default authorizer function checks whether a username exists before validating the password. An attacker can exploit this by observing subtle differences in response times—valid usernames return faster than invalid ones because the password comparison step is skipped entirely for non-existent users. This allows an attacker to reliably discover which usernames are active on a system without needing valid credentials. The flaw affects all versions prior to 3.3.0.

• CVE-2026-45045MEDIUM 5.3

  A flaw in the Fiber web framework allows attackers to inject a false X-Real-IP header that bypasses the proxy's intended override mechanism. When Fiber's BalancerForward proxy helper processes requests, it appends attacker-supplied IP values instead of replacing them, causing upstream systems to log or enforce policies based on the attacker's spoofed IP rather than the true client IP. This undermines logging accuracy, rate-limiting enforcement, and IP-based access controls downstream.

• CVE-2026-53624MEDIUM 4.8

  Fiber, a popular Go web framework modeled after Express, has a flaw in its security middleware that prevents HTTPS security headers from being properly configured. When developers set up Strict-Transport-Security (HSTS) protection—a critical safeguard that tells browsers to only connect via encrypted HTTPS—the middleware fails to apply it because it's checking the wrong property in the connection context. This leaves applications vulnerable to protocol downgrade attacks even when administrators believe they've enabled the protection. The issue is resolved in Fiber version 3.4.0.