CVE-2026-45045: Fiber Web Framework X-Real-IP Header Injection Vulnerability

Technical summary

The BalancerForward proxy helper in Fiber's middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This implementation error allows multiple X-Real-IP values to exist in the same request; if an attacker supplies an X-Real-IP header in their initial request, that value is preserved and forwarded alongside the legitimate one, allowing the attacker's IP to be the first value parsed by upstream systems. The vulnerability is cataloged under CWE-290 (Improper Validation of Specified Quantity in Input), reflecting the failure to enforce a single canonical IP representation.

Business impact

Organizations relying on X-Real-IP for security decisions face direct operational risk. Rate-limiting policies keyed to client IP can be circumvented, authentication logs will attribute requests to spoofed addresses complicating forensic investigation, and IP-based access control lists become unreliable. In regulated environments, inaccurate logging of true client IPs may create compliance violations. The impact is especially acute for SaaS platforms and APIs where per-IP quotas or geographic restrictions are security controls.

Affected systems

Fiber web framework versions prior to 3.3.0 and 2.52.14 are affected. Any deployment using BalancerForward (or relying on X-Real-IP injection via Fiber's proxy middleware) with upstream systems that parse this header is vulnerable. Go-based services using Fiber as their HTTP handler are the direct target; the upstream impact depends on how downstream servers process the X-Real-IP field.

Exploitability

Exploitation requires no authentication, no user interaction, and only network access to the Fiber application. An attacker crafts a request with a custom X-Real-IP header; the flaw guarantees it will be forwarded unchanged. The CVSS score of 5.3 reflects the low attack complexity and network accessibility, moderated by the integrity (not confidentiality or availability) impact and the constraint that actual harm depends on downstream system behavior. Exploitation is trivial from a technical standpoint—any HTTP client can set headers.

Remediation

Upgrade Fiber to version 3.3.0 or later for the main branch, or to version 2.52.14 for the 2.x stable branch. The fix replaces Header.Add() with Header.Set(), ensuring only one X-Real-IP value is present in forwarded requests. Organizations should verify their specific Fiber version against the vendor advisory to confirm their patch target, then apply updates across all Fiber-based services in their environment.

Patch guidance

Identify all services running Fiber by checking go.mod or dependency manifests for the github.com/gofiber/fiber module. Record the current version for each service. For versions prior to 3.3.0 or 2.52.14 (depending on your major version track), plan an upgrade: pull the patched version, test in a staging environment to ensure middleware behavior remains as expected, then promote to production. Given the low to medium severity and the simplicity of the patch (a single method call change), standard change management procedures apply; this is not an emergency patch but should be prioritized in the next regular release cycle.

Detection guidance

Monitor upstream system logs (load balancers, WAF, application servers) for multiple X-Real-IP values in a single request—this indicates header injection. Use HTTP inspection tools or logging middleware to inspect the raw X-Real-IP header value before it reaches your application. Rate-limit and access-control logs that suddenly show traffic from unexpected or impossible IP addresses (e.g., internal IPs or known non-routable ranges appearing in client-attribution fields) may indicate exploitation. Correlate with request timestamps and payloads to identify patterns of spoofing.

Why prioritize this

Although the CVSS score is moderate (5.3), the integrity impact on logging and access control is significant in environments where these are security controls. Unpatched Fiber deployments that feed X-Real-IP to downstream systems for rate-limiting or geo-blocking should patch within 30 days. Organizations without such downstream dependencies (or those that ignore X-Real-IP) face lower risk and can batch the update with routine maintenance. The absence of this CVE from the CISA KEV catalog suggests no active in-the-wild exploitation as of the publication date, reducing immediate pressure but not eliminating the need for timely remediation.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) assigns 5.3 because the attack vector is network-accessible, attack complexity is low, no privileges are required, no user interaction is needed, and the scope is unchanged. The integrity impact is rated 'Low' because the attacker can forge the X-Real-IP value but cannot directly modify data or execute commands—the harm flows through misled downstream systems. Confidentiality and availability are unaffected by the header injection alone. Organizations with strict IP-based security policies may assess their own risk higher than the base score warrants.

Frequently asked questions