TI-2026-82781 CVE-2026-119285 · GHSA-g5jq-qmqr-qrwf
Fiber CORS wildcard origin match ignores dot boundary
Priority MEDIUM 60
Fiber is an Express inspired web framework written in Go.
Vulnerabilities
20 records
TI-2026-32300 CVE-2026-44332 · GHSA-g5vh-55hw-rxm8
Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
Priority LOW 31
Fiber is an Express inspired web framework written in Go.
TI-2026-38670 CVE-2026-53624 · GHSA-gv83-gqw6-9j2c
Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
Priority MEDIUM 55
Fiber is an Express inspired web framework written in Go.
TI-2026-32896 CVE-2026-45045 · GHSA-gcfq-8gqf-4876
Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
Priority LOW 30
Fiber is an Express inspired web framework written in Go.
TI-2026-30834 CVE-2026-42554 · GHSA-qjv7-627w-8qjv
Fiber: XSS in AutoFormat Content Negotiation
Priority MEDIUM 57
Fiber is a web framework for Go.
TI-2026-23477 CVE-2026-30246 · GHSA-35hp-hqmv-8qg8
github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters
Priority HIGH 68
Fiber is a web framework for Go.
TI-2026-20938 CVE-2026-25899 · GHSA-2mr3-m5q5-wgp6
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Priority LOW 39
Fiber is an Express inspired web framework written in Go.
TI-2026-20930 CVE-2026-25891 · GHSA-m3c2-496v-cw3v
Fiber has an Arbitrary File Read in Static Middleware on Windows
Priority MEDIUM 41
Fiber is an Express inspired web framework written in Go.
TI-2026-20922 CVE-2026-25882 · GHSA-mrq8-rjmw-wpq3
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Priority MEDIUM 64
Fiber is an Express inspired web framework written in Go.
TI-2025-41024 CVE-2025-66630 · GHSA-68rr-p4fp-j59v
Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Priority MEDIUM 40
Fiber is an Express inspired web framework written in Go.
TI-2025-40976 CVE-2025-66565 · GHSA-m98w-cqp3-qcqr
Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
Priority HIGH 81
Fiber Utils is a collection of common functions created for Fiber.
TI-2025-34555 CVE-2025-54801 · GHSA-qx2q-88mx-vhg7
Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Priority HIGH 77
Fiber is an Express inspired web framework written in Go.
TI-2025-30446 CVE-2025-48075 · GHSA-hg3g-gphw-5hhm
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Priority HIGH 73
Fiber is an Express-inspired web framework written in Go.
TI-2024-25749 CVE-2024-38513 · GHSA-98j2-3j3p-fw2v
Fiber Session Middleware Token Injection Vulnerability
Priority MEDIUM 50
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above.
TI-2024-16578 CVE-2024-25124 · GHSA-fmg4-x8pw-hjhg
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Priority HIGH 76
Fiber is a web framework written in go.
TI-2024-14792 CVE-2024-22199 · GHSA-4mq2-gc4j-cmw6
Django Template Engine Vulnerable to XSS
Priority MEDIUM 47
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface.
TI-2023-24162 CVE-2023-45141 · GHSA-mv73-f69x-444p
CSRF Token Validation Vulnerability in fiber
Priority MEDIUM 44
Fiber is an express inspired web framework written in Go.
TI-2023-24149 CVE-2023-45128 · GHSA-94w9-97p3-p368
CSRF Token Reuse Vulnerability in fiber
Priority MEDIUM 43
Fiber is an express inspired web framework written in Go.
TI-2023-21938 CVE-2023-41338 · GHSA-3q5p-3558-364f
Vulnerability in Ctx.IsFromLocal() in gofiber
Priority LOW 31
Fiber is an Express inspired web framework built in the go language.
TI-2020-11886 CVE-2020-15111 · GHSA-9cx9-x2gp-9qvh
CRLF vulnerability in Fiber
Priority LOW 26
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack.