github.com/gofiber/fiber/v3 vulnerabilities
CVEs whose affected-version data names the github.com/gofiber/fiber/v3 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-44332Medium· 5.3GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
▾ Sunlitgofiber · github.com/gofiber/fiber/v3EPSS 0.52%via GHSA
CVE-2026-45045Medium· 5.3GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
▾ Sunlitgofiber · github.com/gofiber/fiber/v3EPSS 0.46%via GHSA
CVE-2026-42554MediumFiber vulnerable to XSS in AutoFormat Content Negotiation
Fiber vulnerable to XSS in AutoFormat Content Negotiation
▾ Sunlitgofiber · github.com/gofiber/fiber/v3EPSS 0.21%via OSV
CVE-2026-30246Medium· 6.5Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
▾ Sunlitgofiber · github.com/gofiber/fiber/v3EPSS 0.25%via OSV