TI-2026-30834 Aliases CVE-2026-42554 GHSA-qjv7-627w-8qjv

Fiber: XSS in AutoFormat Content Negotiation

MEDIUM 57CWE-79Published 2026-05-11 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00212 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed fiber (gofiber): 2.52.13, 3.1.0github.com/gofiber/fiber/v3 (Go): 3.2.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gofiber	fiber	before 2.52.13; 3.0.0-beta.2 to before 3.1.0	2.52.13, 3.1.0	Patch available	CNA
—	github.com/gofiber/fiber/v3 (Go)	before 3.2.0	3.2.0	Patch available	GHSA-qjv7-627w-8qjv
—	github.com/gofiber/fiber/v2 (Go)	before 2.52.13	2.52.13	Patch available	GHSA-qjv7-627w-8qjv

fiber Vendorgofiber Affected before 2.52.13; 3.0.0-beta.2 to before 3.1.0 Fixed in 2.52.13, 3.1.0 Patch available CNA
github.com/gofiber/fiber/v3 (Go) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-qjv7-627w-8qjv
github.com/gofiber/fiber/v2 (Go) Vendor— Affected before 2.52.13 Fixed in 2.52.13 Patch available GHSA-qjv7-627w-8qjv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gofiber:fiber::::::go::*	before 2.52.12; 3.0.0 to before 3.1.0	Vulnerable	gofiber

cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:* Versions before 2.52.12; 3.0.0 to before 3.1.0 Vulnerable ·gofiber

Remediation

Fix · CNA fiber (gofiber) Fixed in 2.52.13, 3.1.0
Fix · GHSA-qjv7-627w-8qjv github.com/gofiber/fiber/v3 (Go) Fixed in 3.2.0 Advisory →
Fix · GHSA-qjv7-627w-8qjv github.com/gofiber/fiber/v2 (Go) Fixed in 2.52.13 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-42554
2026-10-03 Alias added: GHSA-qjv7-627w-8qjv

References

TI-2025-34555 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder CVSS 4.0HIGH 8.7
TI-2024-16578 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVSS 3.1CRITICAL 9.8
TI-2025-30446 Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVSS 4.0HIGH 7.7
TI-2026-23477 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters CVSS 3.1MEDIUM 6.5
TI-2026-20922 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVSS 4.0MEDIUM 5.5
TI-2026-38670 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check CVSS 3.1MEDIUM 4.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences