5.3

CVE-2026-45045

Exploit

Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gofiber ≫ Fiber SwPlatformgo Version < 2.52.14
Gofiber ≫ Fiber SwPlatformgo Version >= 3.0.0 < 3.3.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.289
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

https://github.com/gofiber/fiber/releases/tag/v3.3.0
Release Notes
https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876
Vendor Advisory
Exploit
https://github.com/gofiber/fiber/pull/4260
Patch
Issue Tracking
https://github.com/gofiber/fiber/pull/4495
Patch
Issue Tracking
https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396
Patch
https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d
Patch
https://github.com/gofiber/fiber/releases/tag/v2.52.14
Release Notes