Executive brief
Fiber is a popular web development framework for the Go programming language. A security flaw in its 'helmet' protection module prevents the application from properly enforcing encrypted (HTTPS) connections, even when configured to do so. This could allow attackers to intercept or downgrade user connections to unencrypted channels, potentially exposing sensitive data or login credentials.
Technical details
A vulnerability exists in the helmet middleware of the Fiber web framework (prior to version 3.4.0) where the 'Strict-Transport-Security' (HSTS) response header is never emitted. The root cause is a logic error in 'middleware/helmet/helmet.go' where the code checks 'c.Protocol()' for the string 'https' instead of using 'c.Scheme()'. Because 'c.Protocol()' typically returns the application layer protocol (e.g., HTTP/1.1) rather than the URI scheme, the HSTS gating logic fails to recognize secure connections. An attacker could exploit this lack of HSTS to perform man-in-the-middle (MITM) or protocol downgrade attacks. The issue is resolved in version 3.4.0 by switching to 'c.Scheme()' for secure connection detection.
Affected products
- gofiber Fiber < 3.4.0
Timeline
- 2026-06-02: patched: Fix merged into main branch via PR #4389
- 2026-07-02: advisory: Version 3.4.0 released
- 2026-07-08: disclosed: CVE-2026-53624 published