Junglewise Threat Intelligence

CVE-2026-45045: Gofiber Fiber IP spoofing in BalancerForward proxy helper

CVE-2026-45045 · Severity: medium · CVSS 5.3 · Published 2026-07-08

Technologies: Fiber, github.com/gofiber/fiber/v2 (Go), github.com/gofiber/fiber/v3 (Go). Vendors: Fiber, Go.

Executive brief

Fiber, a popular web framework for the Go programming language, contains a flaw in its proxy component that allows attackers to spoof their IP address. When the framework forwards requests to backend servers, it fails to properly overwrite existing identity headers, potentially allowing users to bypass security restrictions like rate limits or access control lists. This could lead to unauthorized access to internal services or the ability to perform automated attacks that would otherwise be blocked.

Technical details

A vulnerability exists in the BalancerForward proxy helper within Fiber's middleware/proxy/proxy.go. The component used the Header.Add() function instead of Header.Set() when injecting the X-Real-IP header. Because Header.Add() appends values rather than replacing them, an attacker-supplied X-Real-IP header remains as the first value in the header list. Many upstream servers (such as Nginx or Express) only process the first instance of this header, leading them to trust the spoofed IP for logging, rate limiting, and IP-based access control (ACLs). The issue is resolved by switching to Header.Set() to ensure the header is overwritten with the legitimate client IP.

Affected products

  • Gofiber Fiber < 2.52.14, >= 3.0.0-beta.2, < 3.3.0

Timeline

  • 2026-05-08: other: Fix merged for v3 branch
  • 2026-05-22: patched: Version 3.3.0 released
  • 2026-07-03: other: Fix backported to v2 branch
  • 2026-07-06: patched: Version 2.52.14 released
  • 2026-07-08: advisory: CVE-2026-45045 published

References

Related threats