PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45045 gofiber CVE debrief

CVE-2026-45045 is a MEDIUM severity vulnerability in Fiber's BalancerForward proxy helper. The issue arises from the use of Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers. This vulnerability is fixed in Fiber versions 3.3.0 and 2.52.14. Affected users should prioritize updating to these versions to mitigate potential risks.

Vendor
gofiber
Product
fiber
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-08
Original CVE updated
2026-07-10
Advisory published
2026-07-08
Advisory updated
2026-07-10

Who should care

Users of Fiber, an Express-inspired web framework written in Go, should be aware of this vulnerability if they are using versions prior to 3.3.0 or 2.52.14. This vulnerability could potentially allow attackers to manipulate logging, rate limiting, and access control mechanisms. Affected operators, platforms, vulnerability-management teams, and security teams should prioritize updating to the fixed versions.

Technical summary

The BalancerForward proxy helper in Fiber's middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP. This allows an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. The vulnerability is fixed in Fiber versions 3.3.0 and 2.52.14. Users should review their deployments and apply necessary updates.

Defensive priority

Medium priority should be given to updating Fiber to versions 3.3.0 or 2.52.14. In the meantime, users can consider monitoring and verifying the X-Real-IP header values being forwarded to upstream servers.

Recommended defensive actions

  • Update Fiber to version 3.3.0 or 2.52.14
  • Monitor and verify X-Real-IP header values
  • Review and adjust logging, rate limiting, and access control mechanisms
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-08T20:16:50.060Z and was last modified on 2026-07-10T19:01:16.053Z. The NVD entry is currently Undergoing Analysis. The vulnerability affects Fiber versions prior to 3.3.0 and 2.52.14. Users should verify their deployments and review official advisories for affected scope and severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-08T20:16:50.060Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.