CVE-2026-45045
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the Fiber web framework for Go, prior to versions 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This allows an attacker to supply a first X-Real-IP value that gets forwarded to upstream servers for logging, rate limiting, and access control.
Risk Assessment
The organization is at risk of bypassing IP-based logging, rate limiting, and access control mechanisms, potentially enabling spoofing or DDoS attacks.
Recommendation
Immediately upgrade the Fiber library to version 3.3.0 or 2.52.14, depending on the major version in use.
Other vulnerabilities in Fiber
See all- CVE-2026-53624Medium
In the Fiber web framework for Go prior to version 3.4.0, the helmet middleware incorrectly checks the protocol using c.Protocol() instead of c.Scheme(), causing the Strict-Transport-Security header to never be set even when HSTSMaxAge is configured. This issue is fixed in version 3.4.0.
- CVE-2026-44332Medium
In the Fiber web framework for Go prior to version 3.3.0, the default Authorizer function in the BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. This allows reliable remote username enumeration through response timing differences.
Original NVD description (English source)
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.