CVE Feed

    Dashboard / CVE / CVE-2026-30246

    CVE-2026-30246

    Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.

    Published:May 5, 2026
    Last Modified:May 12, 2026
    EPS:May 5, 2026
    EPSS Score:0.00036
    CVSS Score:6.5

    Affected Products

    Vendor
    Gofiber
    Product
    Fiber

    Exploits

    https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Related CVEs

    CVE-2026-44332 (CVSS 5.3) — Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in t…
    CVE-2026-53624 (CVSS 4.8) — Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/…
    CVE-2026-45045 (CVSS 5.3) — Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward prox…
    CVE-2026-42554 (CVSS 5.3) — Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber al…
    CVE-2026-25899 (CVSS 7.5) — Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use…
    CVE-2026-25891 (CVSS 7.7) — Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber all…
    CVE-2026-25882 (CVSS 5.5) — Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2…
    CVE-2025-66630 (CVSS 9.2) — Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the un…
    CVE-2025-54801 (CVSS 8.7) — Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx…
    CVE-2025-48075 (CVSS 7.7) — Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High