CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-48075 – Fiber panics when fiber.Ctx.BodyParser parses invalid range index
https://notcve.org/view.php?id=CVE-2025-48075
22 May 2025 — Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue. • https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d • CWE-129: Improper Validation of Array Index •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38513 – Fiber Session Middleware Token Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-38513
01 Jul 2024 — Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's sess... • https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8 • CWE-384: Session Fixation •
CVSS: 9.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25124 – Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
https://notcve.org/view.php?id=CVE-2024-25124
21 Feb 2024 — Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sens... • http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html • CWE-346: Origin Validation Error CWE-942: Permissive Cross-domain Policy with Untrusted Domains •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 0CVE-2024-22199 – Django Template Engine Vulnerable to XSS
https://notcve.org/view.php?id=CVE-2024-22199
11 Jan 2024 — This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.... • https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45141 – CSRF Token Validation Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45141
16 Oct 2023 — Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has... • https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p • CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45128 – CSRF Token Reuse Vulnerability in fiber
https://notcve.org/view.php?id=CVE-2023-45128
16 Oct 2023 — Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is ... • https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019a • CWE-20: Improper Input Validation CWE-352: Cross-Site Request Forgery (CSRF) CWE-565: Reliance on Cookies without Validation and Integrity Checking CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41338 – Vulnerability in Ctx.IsFromLocal() in gofiber
https://notcve.org/view.php?id=CVE-2023-41338
08 Sep 2023 — Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15111 – CRLF vulnerability in Fiber
https://notcve.org/view.php?id=CVE-2020-15111
20 Jul 2020 — In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). En Fiber v... • https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •