Vulnerability GO-2026-5887
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 24, 2026 at 06:35 PM UTC
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.2.0
v3.0.0-beta.2 - v3.2.0
Summary
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber
Details
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 months ago
Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.1.0 GO-2026-5069
v3.0.0-beta.2 - v3.1.0 GO-2026-5069
Unknown
3 months ago
Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.1.0 GO-2026-5585
v3.0.0-beta.2 - v3.1.0 GO-2026-5585
Unknown
3 months ago
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.2.0 GO-2026-5886
v3.0.0-beta.2 - v3.2.0 GO-2026-5886
Unknown
3 months ago
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber
v3.0.0-beta.2 - v3.3.0 GO-2026-5912
v3.0.0-beta.2 - v3.3.0 GO-2026-5912
Medium Risk
4 months ago
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
v3.0.0-beta.2 - v3.2.0 GHSA-gcfq-8gqf-4876
v3.0.0-beta.2 - v3.2.0 GHSA-gcfq-8gqf-4876
Impacted packages
Timeline
Published
3 months ago
July 24, 2026 at 06:35 PM UTC
Fixed (v3.3.0)
5 months ago
May 22, 2026 at 06:53 AM UTC
Last Modified
3 months ago
July 24, 2026 at 07:00 PM UTC