Executive brief
Fiber is a popular web framework for the Go programming language. A flaw in its caching system means that the framework may serve the same cached data to different users even if they requested different information via URL parameters. This could lead to users seeing data intended for someone else or receiving incorrect information from the application.
Technical details
In Gofiber Fiber v3 through version 3.1.0, the default KeyGenerator in the cache middleware uses only the request path (c.Path()) to identify cached responses, omitting the query string. Consequently, requests to the same path with different query parameters (e.g., /api?id=1 and /api?id=2) share the same cache key. This results in a 'cache hit' for subsequent requests with different parameters, serving the first cached response to all users. This behavior can lead to information disclosure or data integrity issues if the application's response depends on query parameters. The issue is resolved in versions following 3.1.0 by including query parameters in the default key generation.
Affected products
- Gofiber Fiber <= 3.1.0
Timeline
- 2026-04-25: advisory: GitHub Security Advisory GHSA-35hp-hqmv-8qg8 published
- 2026-05-05: disclosed: CVE-2026-30246 published
- 2026-05-05: patched: Issue fixed in versions after 3.1.0