CVE-2026-53624mediumCWE-319

CVE-2026-53624: medium-severity vulnerability in gofiber fiber

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Published · Updated

Follow this CVE+ Monitor fiber+ Monitor github.com/gofiber/fiber/v3

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.2%
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
gofiber · fiber
Related CVEs — gofiber fiber

In the same product, most dangerous first.

CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2026-25891HIGHFiber has an Arbitrary File Read in Static Middleware on WindowsEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.7%CVE-2024-25124CRITICALFiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsEPSS 0.7%CVE-2023-41338MEDIUMVulnerability in Ctx.IsFromLocal() in gofiberEPSS 0.7%