CVE-2026-45045mediumCWE-290

CVE-2026-45045: fallo de gravedad media en gofiber fiber

Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear fiber+ Monitorear github.com/gofiber/fiber/v2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
gofiber · fiber
CVEs relacionadas — gofiber fiber

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2026-25891HIGHFiber has an Arbitrary File Read in Static Middleware on WindowsEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.7%CVE-2024-25124CRITICALFiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsEPSS 0.7%CVE-2023-41338MEDIUMVulnerability in Ctx.IsFromLocal() in gofiberEPSS 0.7%