fiber
v3.7.0⚡️ Express inspired web framework written in Go
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- MITPermissive · OSI-approved
- Security
- 19 advisories3 critical, 6 high, 9 medium, 1 low · Scorecard 6.8/10
- Supported versions
- No scheduleendoflife.date does not track this project
40.3k stars · 2.1k forks · 22 open issues · last release 6 days ago · data checked 50 minutes ago
Security advisories
All advisories on GitHubThe 19 most recent advisories published by the maintainers: 3 critical, 6 high, 9 medium, 1 low. Check the patched version against the one you run.
- mediumCVE-2026-119285Oct 23, 2026CORS wildcard origins matched without a dot boundary in v2.52.1 and v2.52.2, allowing credentialed cross-origin reads
- Affected
- >= 2.52.1, <= 2.52.2
- Patched in
- 2.52.3
- mediumCVE-2026-106124Aug 12, 2026idempotency middleware: default MemoryLock leaks one mutex per unique key (memory-exhaustion DoS)
- Affected
- <= v2.52.14
- Patched in
- >= v2.52.15
- mediumCVE-2026-45045Jul 2, 2026X-Real-IP Spoofing via Header.Add() in BalancerForward
- Affected
- <= 3.2.0
- Patched in
- 3.3.0
- mediumCVE-2026-44332Jul 2, 2026Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
- Affected
- <= 3.2.0
- Patched in
- 3.3.0
- mediumCVE-2026-53624Jul 2, 2026HSTS header never set in helmet middleware due to incorrect protocol check in gofiber/fiber
- Affected
- <=v3.3.0
- Patched in
- >=v3.4.0
- mediumCVE-2026-42554Apr 25, 2026XSS in AutoFormat Content Negotiation
- Affected
- <= 3.1.0; <= v2.52.12
- Patched in
- > 3.1.0; > v2.52.12
- mediumCVE-2026-30246Apr 25, 2026Cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
- Affected
- <=3.1.0
- Patched in
- >3.1.0
- lowCVE-2026-25882Feb 24, 2026Denial of Service via Route Parameter Overflow
- Affected
- <= 2.52.11; <= 3.0.0
- Patched in
- 2.52.12; 3.1.0
- highCVE-2026-25891Feb 24, 2026Arbitrary File Read in Static Middleware on Windows
- Affected
- <= 3.0.0
- Patched in
- 3.1.0
- highCVE-2026-25899Feb 24, 2026Denial of Service via Flash Cookie Unbounded Allocation
- Affected
- <=3.0.0
- Patched in
- >=3.1.0
- criticalCVE-2025-66630Feb 7, 2026Utils generate a predictable / zero-UUID on crypto/rand failure
- Affected
- < v2.52.11
- Patched in
- 2.52.11
- highCVE-2025-54801Aug 5, 2025Crash in `BodyParser` Due to Unvalidated Large Slice Index in Decoder
- Affected
- 2.52.8
- Patched in
- 2.52.9
- highCVE-2025-48075May 22, 2025Panic when fiber.Ctx.BodyParser parses invalid range index
- Affected
- >=v2.52.6
- Patched in
- v2.52.7
- criticalCVE-2024-38513Jun 30, 2024Session Middleware Token Injection Vulnerability
- Affected
- < 2.52.4
- Patched in
- >= 2.52.5
- criticalCVE-2024-25124Feb 21, 2024Insecure CORS Configuration Allowing Wildcard Origin with Credentials
- Affected
- < 2.52.1
- Patched in
- >= 2.52.1
- highCVE-2023-45128Oct 16, 2023CSRF Token Injection and Reuse Vulnerability
- Affected
- < 2.50.0
- Patched in
- >= 2.50.0
- highCVE-2023-45141Oct 16, 2023CSRF Token Validation Vulnerability
- Affected
- < 2.50.0
- Patched in
- >= 2.50.0
- mediumCVE-2023-41338Sep 8, 2023Vulnerability in Ctx.IsFromLocal()
- Affected
- < 2.49.1
- Patched in
- >= 2.49.2
- mediumCVE-2020-15111Jul 18, 2020CRLF vulnerability in c.Attachment()
- Affected
- < 1.12.5
- Patched in
- >= 1.12.6