Is CVE-2026-53624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53624 being exploited in the wild.

How severe is CVE-2026-53624?

Medium severity, with a CVSS score of 4.8, published 8 July 2026.

Which products and versions are affected?

Fiber < 3.4.0, <= 3.3.0; github.com/gofiber/fiber (Go) <= 3.3.0, SEMVER:introduced=0,fixed=3.4.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.4.0.

Is there a fix for CVE-2026-53624?

Yes. github.com/gofiber/fiber (Go): upgrade to 3.4.0 or later; github.com/gofiber/fiber/v3 (Go): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53624 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53624?

Check whether you run Fiber, github.com/gofiber/fiber (Go) or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53624: Gofiber Fiber HSTS header omission in helmet middleware

Q: Which products and versions are affected?

Fiber < 3.4.0, <= 3.3.0; github.com/gofiber/fiber (Go) <= 3.3.0, SEMVER:introduced=0,fixed=3.4.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.4.0.

Q: Is there a fix for CVE-2026-53624?

Yes. github.com/gofiber/fiber (Go): upgrade to 3.4.0 or later; github.com/gofiber/fiber/v3 (Go): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53624 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53624?

Check whether you run Fiber, github.com/gofiber/fiber (Go) or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53624 · Severity: medium · CVSS 4.8 · Published 2026-07-08

Fiber is a popular web development framework for the Go programming language. A security flaw in its 'helmet' protection module prevents the application from properly enforcing encrypted (HTTPS) connections, even when configured to do so. This could allow attackers to intercept or downgrade user connections to unencrypted channels, potentially exposing sensitive data or login credentials.

Technologies: Fiber, github.com/gofiber/fiber (Go), github.com/gofiber/fiber/v3 (Go). Vendors: Fiber, Go.

Quick answers

Is CVE-2026-53624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53624 being exploited in the wild.
How severe is CVE-2026-53624?: Medium severity, with a CVSS score of 4.8, published 8 July 2026.
Which products and versions are affected?: Fiber < 3.4.0, <= 3.3.0; github.com/gofiber/fiber (Go) <= 3.3.0, SEMVER:introduced=0,fixed=3.4.0; github.com/gofiber/fiber/v3 (Go) SEMVER:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2026-53624?: Yes. github.com/gofiber/fiber (Go): upgrade to 3.4.0 or later; github.com/gofiber/fiber/v3 (Go): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53624 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53624?: Check whether you run Fiber, github.com/gofiber/fiber (Go) or github.com/gofiber/fiber/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gofiber/fiber (Go): upgrade to 3.4.0 or later
```
go get github.com/gofiber/fiber@v3.4.0
```
github.com/gofiber/fiber/v3 (Go): upgrade to 3.4.0 or later
```
go get github.com/gofiber/fiber/v3@v3.4.0
```

Technical details

A vulnerability exists in the helmet middleware of the Fiber web framework (prior to version 3.4.0) where the 'Strict-Transport-Security' (HSTS) response header is never emitted. The root cause is a logic error in 'middleware/helmet/helmet.go' where the code checks 'c.Protocol()' for the string 'https' instead of using 'c.Scheme()'. Because 'c.Protocol()' typically returns the application layer protocol (e.g., HTTP/1.1) rather than the URI scheme, the HSTS gating logic fails to recognize secure connections. An attacker could exploit this lack of HSTS to perform man-in-the-middle (MITM) or protocol downgrade attacks. The issue is resolved in version 3.4.0 by switching to 'c.Scheme()' for secure connection detection.

Affected products

gofiber Fiber < 3.4.0

Identifiers

CVE-2026-53624
GHSA-gv83-gqw6-9j2c
GO-2026-5912

Timeline

2026-06-02: patched: Fix merged into main branch via PR #4389
2026-07-02: advisory: Version 3.4.0 released
2026-07-08: disclosed: CVE-2026-53624 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.