4.8

CVE-2026-53624

Exploit

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gofiber ≫ Fiber SwPlatformgo Version < 3.4.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.076
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.8 2.2 2.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c
Vendor Advisory
Exploit
https://github.com/gofiber/fiber/pull/4389
Patch
Issue Tracking
https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bf
Patch
https://github.com/gofiber/fiber/releases/tag/v3.4.0
Release Notes