CVE-2026-45045
published 2026-07-08CVE-2026-45045: Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.46%
39.4th percentile
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | gofiber_fiber_v2 | 0 – 2.52.13 | — |
| github.com | gofiber_fiber_v3 | >= 0 < 3.3.0 | 3.3.0 |
| gofiber | fiber | < 2.52.14 | 2.52.14 |
| gofiber | fiber | — | — |
| gofiber | fiber | >= 3.0.0 < 3.3.0 | 3.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
gofiber Fiber up to 2.52.13/3.2.x Proxy Helper proxy.go Header.Add/Header.Set X-Real-IP access control
vuldb·2026-07-13·CVSS 5.3
CVE-2026-45045 [MEDIUM] gofiber Fiber up to 2.52.13/3.2.x Proxy Helper proxy.go Header.Add/Header.Set X-Real-IP access control
A vulnerability marked as problematic has been reported in gofiber Fiber up to 2.52.13/3.2.x. This affects the function Header.Add/Header.Set of the file middleware/proxy/proxy.go of the component Proxy Helper. The manipulation of the argument X-Real-IP leads to improper access controls.
This vulnerability is documented as CVE-2026-45045. The attack can be initiated remotely. There is not any exploit available.
GHSA
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
ghsa·2026-07-02
CVE-2026-45045 [MEDIUM] CWE-290 GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
## Summary
The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.
## Vulnerable Code
**File:** `middleware/proxy/proxy.go`, lines 270-285
```go
func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {
r := &roundrobin{
current: 0,
pool: servers,
}
return func(c fiber.Ctx) error {
server := r.get()
if !strings.HasPrefix(server, "http")
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-45045 golang-github-gofiber-fiber-2: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation [fedora-all]
bugzilla·2026-08-24·CVSS 5.3
CVE-2026-45045 [MEDIUM] CVE-2026-45045 golang-github-gofiber-fiber-2: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation [fedora-all]
CVE-2026-45045 golang-github-gofiber-fiber-2: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
Bugzilla
CVE-2026-45045 github.com/gofiber/fiber: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation
bugzilla·2026-07-08·CVSS 5.3
CVE-2026-45045 [MEDIUM] CVE-2026-45045 github.com/gofiber/fiber: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation
CVE-2026-45045 github.com/gofiber/fiber: GoFiber: IP spoofing allows bypass of security controls via X-Real-IP header manipulation
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37dhttps://github.com/gofiber/fiber/pull/4260https://github.com/gofiber/fiber/pull/4495https://github.com/gofiber/fiber/releases/tag/v2.52.14https://github.com/gofiber/fiber/releases/tag/v3.3.0https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876
2026-07-08
Published