# CVE-2026-30246: Gofiber Fiber response mix-up in cache middleware

Source: https://junglewise.ai/threats/cve-2026-30246-gofiber-fiber-response-mix-up-in-cache-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-30246 · Severity: medium · CVSS 6.5 · Published 2026-05-05

Fiber is a popular web framework for the Go programming language. A flaw in its caching system means that the framework may serve the same cached data to different users even if they requested different information via URL parameters. This could lead to users seeing data intended for someone else or receiving incorrect information from the application.

Technologies: [Fiber](https://junglewise.ai/threats/technologies/fiber), [github.com/gofiber/fiber/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-gofiber-fiber-v3). Vendors: [Fiber](https://junglewise.ai/threats/vendors/fiber), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-30246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30246 being exploited in the wild.

**How severe is CVE-2026-30246?** Medium severity, with a CVSS score of 6.5, published 5 May 2026.

**Which products and versions are affected?** Fiber <= 3.1.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2026-30246?** Yes. github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30246 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30246?** Check whether you run Fiber or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gofiber/fiber/v3 (Go): upgrade to 3.2.0 or later

  ```sh
  go get github.com/gofiber/fiber/v3@v3.2.0
  ```


## Technical details

In Gofiber Fiber v3 through version 3.1.0, the default KeyGenerator in the cache middleware uses only the request path (c.Path()) to identify cached responses, omitting the query string. Consequently, requests to the same path with different query parameters (e.g., /api?id=1 and /api?id=2) share the same cache key. This results in a 'cache hit' for subsequent requests with different parameters, serving the first cached response to all users. This behavior can lead to information disclosure or data integrity issues if the application's response depends on query parameters. The issue is resolved in versions following 3.1.0 by including query parameters in the default key generation.

## Affected products

- Gofiber Fiber <= 3.1.0

## Identifiers

- CVE-2026-30246
- GHSA-35hp-hqmv-8qg8
- GO-2026-5069

## Timeline

- 2026-04-25: advisory: GitHub Security Advisory GHSA-35hp-hqmv-8qg8 published
- 2026-05-05: disclosed: CVE-2026-30246 published
- 2026-05-05: patched: Issue fixed in versions after 3.1.0

## References

- [https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go](https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go)
- [https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go](https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go)
- [https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8](https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8)

## Related threats

- [Gofiber Fiber HSTS header omission in helmet middleware](https://junglewise.ai/threats/cve-2026-53624-gofiber-fiber-hsts-header-omission-in-helmet-middleware)
- [Gofiber Fiber IP spoofing in BalancerForward proxy helper](https://junglewise.ai/threats/cve-2026-45045-gofiber-fiber-ip-spoofing-in-balancerforward-proxy-helper)
- [Gofiber Fiber username enumeration in BasicAuth middleware](https://junglewise.ai/threats/cve-2026-44332-gofiber-fiber-username-enumeration-in-basicauth-middleware)
- [Go Fiber XSS in AutoFormat content negotiation](https://junglewise.ai/threats/cve-2026-42554-go-fiber-xss-in-autoformat-content-negotiation)
- [GO-2026-4534 - Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3](https://junglewise.ai/threats/cve-2026-25899-fiber-is-vulnerable-to-denial-of-service-via-flash-cookie)