Github.Com Gofiber Fiber V3 vulnerabilities

CVE-2026-25891 [HIGH] CWE-22 Fiber has an Arbitrary File Read in Static Middleware on Windows Fiber has an Arbitrary File Read in Static Middleware on Windows ### Summary **Description** A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0. ### Details The vulnerability resides

CVE-2026-25882 [MEDIUM] CWE-129 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow Fiber has a Denial of Service Vulnerability via Route Parameter Overflow A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. ## Aff

CVE-2026-25899 [HIGH] CWE-770 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation ### Summary The use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of w

CVE-2026-30246 [MEDIUM] CWE-200 Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters ### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. As a result, requests like `/?id=1` and `/?id=2` can map to the same cache key and share the sam

CVE-2026-44332 [MEDIUM] CWE-203 GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer ## Summary The default `Authorizer` function in GoFiber's BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. With bcrypt-hashed passwords (the primary use case), the timing difference between a valid and invalid user

CVE-2026-45045 [MEDIUM] CWE-290 GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward ## Summary The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx

CVE-2026-42554 [MEDIUM] CWE-79 Fiber vulnerable to XSS in AutoFormat Content Negotiation Fiber vulnerable to XSS in AutoFormat Content Negotiation ## Summary **Description** A Cross-Site Scripting (CWE-79) vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying `Accept: text/html` on any request whose handler passes attacker-influenced data to the AutoFormat() feature. This affects `github.com/gofiber/fiber/v3` (`DefaultRes.AutoFormat`) through vers