CVE-2026-45045: Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
Vulnerability summary
CVE-2026-45045 is a medium (CVSS 5.3) Authentication Bypass by Spoofing vulnerability in gofiber fiber. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.46% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFiber
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- gatus< 5.36.0-r8
- gatus-fips< 5.36.0-r8
Github.com/gofiber/fiber2 products
- v2< 2.52.14
- v3< 3.3.0
Ubuntu2 products
- golang-github-gofiber-fiberAll versions (No fix recorded)
- golang-github-gofiber-fiber-v2All versions (No fix recorded)
Gofiber1 product
- fiber≥ 3.0.0-beta.2, < 3.3.0 | < 2.52.14 | ≥ 3.0.0, < 3.3.0
Wolfi1 product
- gatus< 5.36.0-r8
5 vendors · 8 products
References
12 links- github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876X Refsource CONFIRMAdvisoryWEBExploitVendor AdvisoryREPORT
- github.com/gofiber/fiber/commit/1403cc8292da3220e9316960b4030cc722a0f396X Refsource MISCFIXWEBPatchREPORT
- github.com/gofiber/fiber/commit/33c9501288ab47a429c8b5e701493f0c3c0af37dX Refsource MISCFIXWEBPatchREPORT
- github.com/gofiber/fiberPACKAGE