TI-2025-34555 CVE-2025-54801 · GHSA-qx2q-88mx-vhg7
Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Priority HIGH 77
Fiber is an Express inspired web framework written in Go.
gofiber
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
gofiber records in CISA KEVNo gofiber vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records in Fiber · all components
TI-2024-16578 CVE-2024-25124 · GHSA-fmg4-x8pw-hjhg
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Priority HIGH 76
Fiber is a web framework written in go.
TI-2025-30446 CVE-2025-48075 · GHSA-hg3g-gphw-5hhm
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Priority HIGH 73
Fiber is an Express-inspired web framework written in Go.
TI-2026-23477 CVE-2026-30246 · GHSA-35hp-hqmv-8qg8
github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters
Priority HIGH 68
Fiber is a web framework for Go.
TI-2026-20922 CVE-2026-25882 · GHSA-mrq8-rjmw-wpq3
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Priority MEDIUM 64
Fiber is an Express inspired web framework written in Go.
TI-2026-30834 CVE-2026-42554 · GHSA-qjv7-627w-8qjv
Fiber: XSS in AutoFormat Content Negotiation
Priority MEDIUM 57
Fiber is a web framework for Go.
TI-2026-38670 CVE-2026-53624 · GHSA-gv83-gqw6-9j2c
Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
Priority MEDIUM 55
Fiber is an Express inspired web framework written in Go.
TI-2024-25749 CVE-2024-38513 · GHSA-98j2-3j3p-fw2v
Fiber Session Middleware Token Injection Vulnerability
Priority MEDIUM 50
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above.
TI-2023-24162 CVE-2023-45141 · GHSA-mv73-f69x-444p
CSRF Token Validation Vulnerability in fiber
Priority MEDIUM 44
Fiber is an express inspired web framework written in Go.
TI-2023-24149 CVE-2023-45128 · GHSA-94w9-97p3-p368
CSRF Token Reuse Vulnerability in fiber
Priority MEDIUM 43
Fiber is an express inspired web framework written in Go.
TI-2026-20930 CVE-2026-25891 · GHSA-m3c2-496v-cw3v
Fiber has an Arbitrary File Read in Static Middleware on Windows
Priority MEDIUM 41
Fiber is an Express inspired web framework written in Go.
TI-2025-41024 CVE-2025-66630 · GHSA-68rr-p4fp-j59v
Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Priority MEDIUM 40
Fiber is an Express inspired web framework written in Go.
TI-2026-20938 CVE-2026-25899 · GHSA-2mr3-m5q5-wgp6
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Priority LOW 39
Fiber is an Express inspired web framework written in Go.
TI-2026-32300 CVE-2026-44332 · GHSA-g5vh-55hw-rxm8
Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
Priority LOW 31
Fiber is an Express inspired web framework written in Go.
TI-2023-21938 CVE-2023-41338 · GHSA-3q5p-3558-364f
Vulnerability in Ctx.IsFromLocal() in gofiber
Priority LOW 31
Fiber is an Express inspired web framework built in the go language.
TI-2026-32896 CVE-2026-45045 · GHSA-gcfq-8gqf-4876
Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
Priority LOW 30
Fiber is an Express inspired web framework written in Go.
TI-2020-11886 CVE-2020-15111 · GHSA-9cx9-x2gp-9qvh
CRLF vulnerability in Fiber
Priority LOW 26
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack.