CVE Feed

    Dashboard / CVE / CVE-2023-41338

    CVE-2023-41338

    Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version.

    Published:Sep 8, 2023
    Last Modified:Nov 21, 2024
    EPS:Sep 8, 2023
    EPSS Score:0.00334
    CVSS Score:5.3

    Affected Products

    Vendor
    Gofiber
    Product
    Fiber

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-44332 (CVSS 5.3) — Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in t…
    CVE-2026-53624 (CVSS 4.8) — Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/…
    CVE-2026-45045 (CVSS 5.3) — Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward prox…
    CVE-2026-42554 (CVSS 5.3) — Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber al…
    CVE-2026-30246 (CVSS 6.5) — Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key genera…
    CVE-2026-25899 (CVSS 7.5) — Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use…
    CVE-2026-25891 (CVSS 7.7) — Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber all…
    CVE-2026-25882 (CVSS 5.5) — Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2…
    CVE-2025-66630 (CVSS 9.2) — Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the un…
    CVE-2025-54801 (CVSS 8.7) — Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High