CVE-2026-45045: Gofiber Fiber IP spoofing in BalancerForward proxy helper

CVE-2026-45045 · Severity: medium · CVSS 5.3 · Published 2026-07-08

Fiber, a popular web framework for the Go programming language, contains a flaw in its proxy component that allows attackers to spoof their IP address. When the framework forwards requests to backend servers, it fails to properly overwrite existing identity headers, potentially allowing users to bypass security restrictions like rate limits or access control lists. This could lead to unauthorized access to internal services or the ability to perform automated attacks that would otherwise be blocked.

Technologies: Fiber, github.com/gofiber/fiber/v2 (Go), github.com/gofiber/fiber/v3 (Go). Vendors: Fiber, Go.

Quick answers

Is CVE-2026-45045 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45045 being exploited in the wild.
How severe is CVE-2026-45045?
Medium severity, with a CVSS score of 5.3, published 8 July 2026.
Which products and versions are affected?
Fiber < 2.52.14, >= 3.0.0-beta.2, < 3.3.0, v2 <= 2.52.13, v3 <= 3.2.0; github.com/gofiber/fiber/v2 (Go) <= 2.52.13, SEMVER:introduced=0,fixed=2.52.14; github.com/gofiber/fiber/v3 (Go) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0.
Is there a fix for CVE-2026-45045?
Yes. github.com/gofiber/fiber/v2 (Go): upgrade to 2.52.14 or later; github.com/gofiber/fiber/v3 (Go): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45045 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45045?
Check whether you run Fiber, github.com/gofiber/fiber/v2 (Go) or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gofiber/fiber/v2 (Go): upgrade to 2.52.14 or later
    go get github.com/gofiber/fiber/v2@v2.52.14
  • github.com/gofiber/fiber/v3 (Go): upgrade to 3.3.0 or later
    go get github.com/gofiber/fiber/v3@v3.3.0

Technical details

A vulnerability exists in the BalancerForward proxy helper within Fiber's middleware/proxy/proxy.go. The component used the Header.Add() function instead of Header.Set() when injecting the X-Real-IP header. Because Header.Add() appends values rather than replacing them, an attacker-supplied X-Real-IP header remains as the first value in the header list. Many upstream servers (such as Nginx or Express) only process the first instance of this header, leading them to trust the spoofed IP for logging, rate limiting, and IP-based access control (ACLs). The issue is resolved by switching to Header.Set() to ensure the header is overwritten with the legitimate client IP.

Affected products

  • Gofiber Fiber < 2.52.14, >= 3.0.0-beta.2, < 3.3.0

Identifiers

  • CVE-2026-45045
  • GHSA-gcfq-8gqf-4876
  • GO-2026-5887

Timeline

  • 2026-05-08: other: Fix merged for v3 branch
  • 2026-05-22: patched: Version 3.3.0 released
  • 2026-07-03: other: Fix backported to v2 branch
  • 2026-07-06: patched: Version 2.52.14 released
  • 2026-07-08: advisory: CVE-2026-45045 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.