{"id":"EUVD-2026-29328","enisaUuid":"3a48f842-081b-3720-9d8e-4c8404e6f806","description":"Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph \"safe, format-agnostic reply.\" This vulnerability is fixed in 2.52.12 and 3.1.0.","datePublished":"May 11, 2026, 9:47:17 PM","dateUpdated":"May 15, 2026, 6:24:38 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv\n","aliases":"CVE-2026-42554\nGHSA-qjv7-627w-8qjv\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"7911f815-e1b8-3ce0-845b-ce5721ccb3f8","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"\u003c 2.52.13"},{"id":"c26bf328-7a01-3281-be0f-bc5e5214d5a2","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"3.0.0-beta.2, \u003c 3.1.0"}],"enisaIdVendor":[{"id":"376c65e3-4bd1-340a-b73d-da4f1f9b8321","vendor":{"name":"gofiber"}}],"enisaIdVulnerability":[{"id":"1d84558f-881b-31e6-8e8f-fb4971a91472","vulnerability":{"id":"CVE-2026-42554","description":"Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph \"safe, format-agnostic reply.\" This vulnerability is fixed in 2.52.12 and 3.1.0.","datePublished":"May 11, 2026, 9:47:17 PM","dateUpdated":"May 15, 2026, 6:24:38 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv\n","enisa_id":"EUVD-2026-29328\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 1, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"1594b66e-f3c4-3006-b58d-f66f421a2e89","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"3.0.0-beta.2, \u003c 3.1.0"},{"id":"d1e83f4e-ece7-309e-ba38-34ac2ba115ac","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"\u003c 2.52.13"}],"vulnerabilityVendor":[{"id":"3b2dd983-57c5-391a-8a90-fed4fc25f3bb","vendor":{"name":"gofiber"}}]}},{"id":"994996b2-da08-3886-888a-d5951868abdf","vulnerability":{"id":"GHSA-qjv7-627w-8qjv","description":"Fiber vulnerable to XSS in AutoFormat Content Negotiation","datePublished":"May 5, 2026, 8:13:23 PM","dateUpdated":"May 13, 2026, 2:20:14 PM","baseScore":0.0,"references":"https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42554\nhttps://github.com/gofiber/fiber\n","enisa_id":"EUVD-2026-29328\n","aliases":"GHSA-qjv7-627w-8qjv\nCVE-2026-42554\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}