CVE-2026-45045

Katalog CVE

CVSS 5.3 · Medium EPSS 0,46%

Kerentanan Authentication Bypass by Spoofing pada gofiber fiber. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 exploit · advisory vendor
• https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396 patch
• https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d patch
• https://github.com/gofiber/fiber/pull/4260 issue tracking · patch
• https://github.com/gofiber/fiber/pull/4495 issue tracking · patch
• https://github.com/gofiber/fiber/releases/tag/v2.52.14 release notes
• https://github.com/gofiber/fiber/releases/tag/v3.3.0 release notes