{"id":"EUVD-2026-42351","enisaUuid":"aa2fb8e7-a023-37e7-800a-de28b7272c0d","description":"Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.","datePublished":"Jul 8, 2026, 7:26:26 PM","dateUpdated":"Jul 9, 2026, 1:20:08 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876\nhttps://github.com/gofiber/fiber/pull/4260\nhttps://github.com/gofiber/fiber/pull/4495\nhttps://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396\nhttps://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d\nhttps://github.com/gofiber/fiber/releases/tag/v2.52.14\nhttps://github.com/gofiber/fiber/releases/tag/v3.3.0\n","aliases":"CVE-2026-45045\nGHSA-gcfq-8gqf-4876\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"3cf1fef4-243e-358f-b187-506dc508e499","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"3.0.0-beta.2, \u003c 3.3.0"},{"id":"7ec35d90-77a5-3695-903b-f01eb1ae6768","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"\u003c 2.52.14"}],"enisaIdVendor":[{"id":"cbe68cee-2418-34aa-aab5-0ae79b8d32d7","vendor":{"name":"gofiber"}}],"enisaIdVulnerability":[{"id":"3e904df3-c5be-3c9a-bace-d237d66d950a","vulnerability":{"id":"GHSA-gcfq-8gqf-4876","description":"GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward","datePublished":"Jul 2, 2026, 1:50:45 PM","dateUpdated":"Aug 4, 2026, 9:52:02 PM","baseScore":0.0,"references":"https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45045\nhttps://github.com/gofiber/fiber/pull/4260\nhttps://github.com/gofiber/fiber/pull/4495\nhttps://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396\nhttps://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d\nhttps://github.com/gofiber/fiber\nhttps://github.com/gofiber/fiber/releases/tag/v2.52.14\nhttps://github.com/gofiber/fiber/releases/tag/v3.3.0\n","enisa_id":"EUVD-2026-42351\n","aliases":"GHSA-gcfq-8gqf-4876\nCVE-2026-45045\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"56c67fd7-51d7-3855-be57-2549c2d5e8d0","vulnerability":{"id":"CVE-2026-45045","description":"Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.","datePublished":"Jul 8, 2026, 7:26:26 PM","dateUpdated":"Jul 9, 2026, 1:20:08 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876\nhttps://github.com/gofiber/fiber/pull/4260\nhttps://github.com/gofiber/fiber/pull/4495\nhttps://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396\nhttps://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d\nhttps://github.com/gofiber/fiber/releases/tag/v2.52.14\nhttps://github.com/gofiber/fiber/releases/tag/v3.3.0\n","enisa_id":"EUVD-2026-42351\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"21a94eca-6c21-376f-b0b8-b82657e4a2c6","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"3.0.0-beta.2, \u003c 3.3.0"},{"id":"8fbd2785-a052-372a-9efd-92e975c6bc77","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"\u003c 2.52.14"}],"vulnerabilityVendor":[{"id":"b5e04e71-40fc-3104-b9e7-4742f7906e7f","vendor":{"name":"gofiber"}}]}}],"enisaIdAdvisory":[]}