Fiber Session Middleware Token Injection Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-384.
Summary
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gofiber | fiber | before 2.52.5 | 2.52.5 | Patch available | CNA |
| — | github.com/gofiber/fiber (Go) | before 2.52.5 | 2.52.5 | Patch available | GHSA-98j2-3j3p-fw2v |
| — | github.com/gofiber/fiber/v2 (Go) | before 2.52.5 | 2.52.5 | Patch available | GHSA-98j2-3j3p-fw2v |
| — | github.com/gofiber/fiber/v2/middleware/session (Go) | before 2.52.5 | 2.52.5 | Patch available | GHSA-98j2-3j3p-fw2v |
- fiber Vendorgofiber Affected before 2.52.5 Fixed in 2.52.5 Patch available CNA
- github.com/gofiber/fiber (Go) Vendor— Affected before 2.52.5 Fixed in 2.52.5 Patch available GHSA-98j2-3j3p-fw2v
- github.com/gofiber/fiber/v2 (Go) Vendor— Affected before 2.52.5 Fixed in 2.52.5 Patch available GHSA-98j2-3j3p-fw2v
- github.com/gofiber/fiber/v2/middleware/session (Go) Vendor— Affected before 2.52.5 Fixed in 2.52.5 Patch available GHSA-98j2-3j3p-fw2v
Remediation
- Fix · CNA fiber (gofiber) Fixed in 2.52.5
- Fix · GHSA-98j2-3j3p-fw2v github.com/gofiber/fiber (Go) Fixed in 2.52.5 Advisory →
- Fix · GHSA-98j2-3j3p-fw2v github.com/gofiber/fiber/v2 (Go) Fixed in 2.52.5 Advisory →
- Fix · GHSA-98j2-3j3p-fw2v github.com/gofiber/fiber/v2/middleware/session (Go) Fixed in 2.52.5 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38513
- 2026-10-03 Alias added: GHSA-98j2-3j3p-fw2v
References
Advisory 2
More gofiber Fiber vulnerabilities
- TI-2025-34555 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder CVSS 4.0HIGH 8.7
- TI-2024-16578 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVSS 3.1CRITICAL 9.8
- TI-2025-30446 Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVSS 4.0HIGH 7.7
- TI-2026-23477 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters CVSS 3.1MEDIUM 6.5
- TI-2026-20922 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVSS 4.0MEDIUM 5.5
- TI-2026-30834 Fiber: XSS in AutoFormat Content Negotiation CVSS 4.0MEDIUM 5.3
Sources
- CVE-2024-38513 · CVE Program
- CVE-2024-38513 · NVD
- FIRST EPSS
- GHSA-98j2-3j3p-fw2v · GitHub Advisory Database · CC BY 4.0
- CVE-2024-38513 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences