{"id":"CVE-2026-30246","revision":"96437eb9c0314679854c459257a387f3","records":[{"revision":"96437eb9c0314679854c459257a387f3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-30246","aliases":[],"title":"github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters","description":"Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.","state":0,"publishedAt":"2026-05-05T12:40:19.813+00:00","modifiedAt":"2026-05-05T15:04:02.984+00:00","affected":[{"ecosystem":"Vendor product","name":"fiber","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gofiber\",\n                    \"product\": \"fiber\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= v3.0.0-beta.2, < 3.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8","https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621","https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-30246","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-30246","identifiers":["CVE-2026-30246"]},"retained":false,"historicalAffected":[]}],"coverage":[]}