Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
Fix
Patch, vendor advisory and mitigation references on NVD 5
- https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396 Patch
- https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d Patch
- https://github.com/gofiber/fiber/pull/4260 Issue Tracking, Patch
- https://github.com/gofiber/fiber/pull/4495 Issue Tracking, Patch
- https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · gofiberNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*
References 7
- https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396 Patch
- https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d Patch
- https://github.com/gofiber/fiber/pull/4260 Issue Tracking, Patch
- https://github.com/gofiber/fiber/pull/4495 Issue Tracking, Patch
- https://github.com/gofiber/fiber/releases/tag/v2.52.14 Release Notes
- https://github.com/gofiber/fiber/releases/tag/v3.3.0 Release Notes
- https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 Exploit, Vendor Advisory