Is CVE-2026-30246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30246 being exploited in the wild.

How severe is CVE-2026-30246?

Medium severity, with a CVSS score of 6.5, published 5 May 2026.

Which products and versions are affected?

Fiber <= 3.1.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.2.0.

Is there a fix for CVE-2026-30246?

Yes. github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30246 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-30246?

Check whether you run Fiber or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30246: Gofiber Fiber response mix-up in cache middleware

Q: Which products and versions are affected?

Fiber <= 3.1.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.2.0.

Q: Is there a fix for CVE-2026-30246?

Yes. github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30246 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-30246?

Check whether you run Fiber or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30246 · Severity: medium · CVSS 6.5 · Published 2026-05-05

Fiber is a popular web framework for the Go programming language. A flaw in its caching system means that the framework may serve the same cached data to different users even if they requested different information via URL parameters. This could lead to users seeing data intended for someone else or receiving incorrect information from the application.

Technologies: Fiber, github.com/gofiber/fiber/v3 (Go). Vendors: Fiber, Go.

Quick answers

Is CVE-2026-30246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30246 being exploited in the wild.
How severe is CVE-2026-30246?: Medium severity, with a CVSS score of 6.5, published 5 May 2026.
Which products and versions are affected?: Fiber <= 3.1.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2026-30246?: Yes. github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30246 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-30246?: Check whether you run Fiber or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later
```
go get github.com/gofiber/fiber/v3@v3.2.0
```

Technical details

In Gofiber Fiber v3 through version 3.1.0, the default KeyGenerator in the cache middleware uses only the request path (c.Path()) to identify cached responses, omitting the query string. Consequently, requests to the same path with different query parameters (e.g., /api?id=1 and /api?id=2) share the same cache key. This results in a 'cache hit' for subsequent requests with different parameters, serving the first cached response to all users. This behavior can lead to information disclosure or data integrity issues if the application's response depends on query parameters. The issue is resolved in versions following 3.1.0 by including query parameters in the default key generation.

Affected products

Gofiber Fiber <= 3.1.0

Identifiers

CVE-2026-30246
GHSA-35hp-hqmv-8qg8
GO-2026-5069

Timeline

2026-04-25: advisory: GitHub Security Advisory GHSA-35hp-hqmv-8qg8 published
2026-05-05: disclosed: CVE-2026-30246 published
2026-05-05: patched: Issue fixed in versions after 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.