GO
Vendor
gofiber
21
CVEs
0
On KEV
1
New 30D
Products
FI9.8
fiber
gofiber
18 CVEs0 on KEV1 new
DJ6.1
Django
Gofiber
1 CVEs0 on KEV0 new
TE6.1
template
gofiber
1 CVEs0 on KEV0 new
UT9.8
utils
gofiber
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119285 New | FI fiber gofiber | 5.9 | Oct 29 | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads |
| CVE-2026-44332 | FI fiber gofiber | 5.3 | Jul 8 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer |
| CVE-2026-53624 | FI fiber gofiber | 4.8 | Jul 8 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol check |
| CVE-2026-45045 | FI fiber gofiber | 5.3 | Jul 8 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward |
| CVE-2026-42554 | FI fiber gofiber | 6.1 | May 11 | Fiber: XSS in AutoFormat Content Negotiation |
| CVE-2026-30246 | FI fiber gofiber | 6.5 | May 5 | github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters |
| CVE-2026-25899 | FI fiber gofiber | 7.5 | Feb 24 | Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation |
| CVE-2026-25891 | FI fiber gofiber | 7.5 | Feb 24 | Fiber has an Arbitrary File Read in Static Middleware on Windows |
| CVE-2026-25882 | FI fiber gofiber | 7.5 | Feb 24 | Fiber has a Denial of Service Vulnerability via Route Parameter Overflow |
| CVE-2025-66630 | FI fiber gofiber | 9.4 | Feb 9 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure |
| CVE-2025-66565 | UT utils gofiber | 9.8 | Dec 9 | Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values |
| CVE-2025-54801 | FI fiber gofiber | 7.5 | Aug 5 | Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder |
| CVE-2025-48075 | FI fiber gofiber | 7.5 | May 22 | Fiber panics when fiber.Ctx.BodyParser parses invalid range index |
| CVE-2024-38513 | FI fiber gofiber | 9.8 | Jul 1 | Fiber Session Middleware Token Injection Vulnerability |
| CVE-2024-25124 | FI fiber gofiber | 9.8 | Feb 21 | Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials |
| CVE-2024-22199 | TE template gofiber | 6.1 | Jan 11 | Django Template Engine Vulnerable to XSS |
| CVE-2023-45141 | FI fiber gofiber | 8.8 | Oct 16 | CSRF Token Validation Vulnerability in fiber |
| CVE-2023-45128 | FI fiber gofiber | 8.8 | Oct 16 | CSRF Token Reuse Vulnerability in fiber |
| CVE-2023-41338 | FI fiber gofiber | 5.3 | Sep 8 | Vulnerability in Ctx.IsFromLocal() in gofiber |
| CVE-2020-15111 | FI Fiber Gofiber | 5.4 | Jul 20 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection… |