gofiber has 10 CVEs on record between 2021 and 2026. The busiest recent month was July 2026 with 3. The median CVSS is 5.3 (medium), with 3 rated critical. None have a confirmed exploitation report. Most affected products: github.com/gofiber/fiber/v3 (4), github.com/gofiber/fiber (3), github.com/gofiber/fiber/v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Products
- github.com/gofiber/fiber/v3 4
- github.com/gofiber/fiber 3
- github.com/gofiber/fiber/v2 1
- github.com/gofiber/template/django/v3 1
- utils 1
Worst active — by depth score
CVE-2025-66565Critical· 9.8Fiber Utils is a collection of common functions created for Fiber54CVE-2025-66630CriticalFiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure52CVE-2024-22199Critical· 9.3Django Template Engine Vulnerable to XSS51CVE-2026-30246Medium· 6.5Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters36CVE-2026-45045Medium· 5.3GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward29
gofiber vulnerabilities
CVEs affecting gofiber, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-53624Medium· 4.8GoFiber never set HSTS header in helmet middleware due to incorrect protocol check
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check
CVE-2026-44332Medium· 5.3GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
CVE-2026-45045Medium· 5.3GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
CVE-2026-42554MediumFiber vulnerable to XSS in AutoFormat Content Negotiation
Fiber vulnerable to XSS in AutoFormat Content Negotiation
CVE-2026-30246Medium· 6.5Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
CVE-2025-66630CriticalFiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
CVE-2025-66565Critical· 9.8Fiber Utils is a collection of common functions created for Fiber
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable …
CVE-2024-22199Critical· 9.3Django Template Engine Vulnerable to XSS
Django Template Engine Vulnerable to XSS
CVE-2023-41338Medium· 5.3Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
CVE-2020-15111Medium· 4.2CRLF vulnerability in Fiber
CRLF vulnerability in Fiber