Gofiber vulnerabilities
We track 11 vulnerabilities in Gofiber products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on February 24, 2026.
Latest Gofiber vulnerabilities
- 7.5 High severity
fiber: Allocation of Resources Without Limits or Throttling
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up t
- 7.5 High severity
fiber: Improper Limitation of a Pathname to a Restricted Directory
Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 t
- 7.5 High severity
fiber: Improper Validation of Array Index
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results fr
- 9.4 Critical severity
fiber: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID fun
- 9.8 Critical severity
utils: Unchecked Return Value
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including
- 7.5 High severity
fiber: Memory Allocation with Excessive Size Value
Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due t
- 7.5 High severity
fiber: Improper Validation of Array Index
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of ret
- 9.8 Critical severity
fiber: Session Fixation
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the c
- 9.8 Critical severity
fiber: Origin Validation Error
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-A
- 8.8 High severity
fiber: Cross-Site Request Forgery
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to una
- 8.8 High severity
Fiber is an express inspired web framework written in Go.
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulne