Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bf Patch
- https://github.com/gofiber/fiber/pull/4389 Issue Tracking, Patch
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c Exploit, Vendor Advisory
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.8 · gofiberNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*
References 5
- https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bf Patch
- https://github.com/gofiber/fiber/pull/4389 Issue Tracking, Patch
- https://github.com/gofiber/fiber/releases/tag/v3.4.0 Release Notes
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c Exploit, Vendor Advisory
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c Exploit, Vendor Advisory