Github.Com Fabiolb Fabio vulnerabilities

CVE-2025-48865 [CRITICAL] CWE-345 Fabio allows HTTP clients to manipulate custom headers it adds Fabio allows HTTP clients to manipulate custom headers it adds ### Summary Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP

CVE-2026-62987 [CRITICAL] CWE-290 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header **Affected:** github.com/fabiolb/fabio >= 1.6.6 through 1.7.1 and master HEAD (c75f8a6). ### Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client `Connection` header a