CVE-2026-45045 MEDIUM

CVE-2026-45045: Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward

Vendor Gofiber
Product fiber
Weakness CWE-290
Published July 8, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 9, 2026 Record updated