{"id":"EUVD-2026-27313","enisaUuid":"a45a17d0-718a-3183-8792-706771d1aac8","description":"Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.","datePublished":"May 5, 2026, 12:40:19 PM","dateUpdated":"May 5, 2026, 3:04:02 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92\n","aliases":"CVE-2026-30246\nGHSA-35hp-hqmv-8qg8\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"8e7cd6b9-8e6a-3155-8bdd-b5b75ebc7051","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"v3.0.0-beta.2, \u003c 3.1.0"}],"enisaIdVendor":[{"id":"d7c40005-afb5-384a-886e-dc6d9f660a0b","vendor":{"name":"gofiber"}}],"enisaIdVulnerability":[{"id":"1839894a-3da6-3f56-ae8a-e89b127c2d03","vulnerability":{"id":"GHSA-35hp-hqmv-8qg8","description":"Fiber\u0027s cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters","datePublished":"Apr 28, 2026, 10:28:14 PM","dateUpdated":"May 8, 2026, 1:42:45 PM","baseScore":0.0,"references":"https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30246\nhttps://github.com/gofiber/fiber/commit/050ff1ff18511c1475b8ec627460216aaecddd4e\nhttps://github.com/gofiber/fiber/commit/9a0d12c07ed895b84c72987f9288b04137afe5de\nhttps://github.com/gofiber/fiber\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92\n","enisa_id":"EUVD-2026-27313\n","aliases":"GHSA-35hp-hqmv-8qg8\nCVE-2026-30246\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"66456b42-b79a-32fe-8264-1cc71f50242e","vulnerability":{"id":"CVE-2026-30246","description":"Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.","datePublished":"May 5, 2026, 12:40:19 PM","dateUpdated":"May 5, 2026, 3:04:02 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621\nhttps://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92\n","enisa_id":"EUVD-2026-27313\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 1, 2026, 4:06:07 AM","vulnerabilityProduct":[{"id":"02133aec-1d3f-3b7a-af4e-97082ad93b89","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"v3.0.0-beta.2, \u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"2bd3f512-8ae1-3dcc-9dfb-f423d5f0dfe1","vendor":{"name":"gofiber"}}]}}],"enisaIdAdvisory":[]}