Vulnerability GO-2026-5585
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 24, 2026 at 06:35 PM UTC
Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
v2.0.0 - v2.52.12
v2.0.0 - v2.52.12
Summary
Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
Details
Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
v2.52.1 - v2.52.2 GHSA-g5jq-qmqr-qrwf
v2.52.1 - v2.52.2 GHSA-g5jq-qmqr-qrwf
Unknown
3 months ago
Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.1.0 GO-2026-5069
v3.0.0-beta.2 - v3.1.0 GO-2026-5069
Unknown
3 months ago
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.2.0 GO-2026-5886
v3.0.0-beta.2 - v3.2.0 GO-2026-5886
Unknown
3 months ago
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.2.0 GO-2026-5887
v3.0.0-beta.2 - v3.2.0 GO-2026-5887
Unknown
3 months ago
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.3.0 GO-2026-5912
v3.0.0-beta.2 - v3.3.0 GO-2026-5912
Impacted packages
Timeline
Published
3 months ago
July 24, 2026 at 06:35 PM UTC
Fixed (v3.2.0)
6 months ago
April 25, 2026 at 10:49 AM UTC
Fixed (v2.52.13)
6 months ago
April 25, 2026 at 01:05 PM UTC
Last Modified
3 months ago
July 24, 2026 at 07:00 PM UTC