Go/github.com/gofiber/fiber/v3 CVE-2026-45045: medium 5.3, EPSS 0.46%

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Action: Upgrade github.com/gofiber/fiber/v3 to 3.3.0 or later.

go get github.com/gofiber/fiber/v3@v3.3.0

Affected

Fixed versions

Sources

• osv: GHSA-gcfq-8gqf-4876
• https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876
• https://nvd.nist.gov/vuln/detail/CVE-2026-45045
• https://github.com/gofiber/fiber/pull/4260
• https://github.com/gofiber/fiber/pull/4495
• https://github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396
• https://github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37d
• https://github.com/gofiber/fiber
• https://github.com/gofiber/fiber/releases/tag/v2.52.14
• https://github.com/gofiber/fiber/releases/tag/v3.3.0

CVE-2026-45045 · published 2026-07-02T13:50:45Z · modified 2026-09-10T03:50:52.054200484Z · JSON