CVE-2025-48865: Fabio HTTP Header Manipulation Vulnerability
Summary
CVE-2025-48865: Fabio allows HTTP clients to manipulate custom headers it adds. Affects github.com/fabiolb/fabio versions < 1.6.6. Fixed in 1.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fabio is an open-source load balancer and reverse proxy designed for routing HTTP requests to backend applications. It enhances application performance by adding custom HTTP headers such as X-Forwarded-Host and X-Forwarded-Port. However, due to a vulnerability in its handling of hop-by-hop headers, it allows HTTP clients to manipulate or remove these headers, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from Fabio's processing of hop-by-hop headers, which allows clients to remove critical X-Forwarded headers (except X-Forwarded-For). By exploiting the HTTP Connection header, attackers can strip headers like X-Forwarded-Host, X-Forwarded-Port, and X-Real-IP. This manipulation can lead to access control bypass and other security-sensitive issues, as backend applications may rely on these headers for making security decisions.
How To Fix
Latest published version: v1.8.0 as of 23 Oct 2026
go get github.com/fabiolb/fabio@v1.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.6
This is the first release that contains the fix.
go get github.com/fabiolb/fabio@v1.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid trusting the X-Forwarded headers for security-sensitive operations until the patch is applied. Additionally, consider implementing additional validation checks on the backend to ensure the integrity of the incoming requests.
Conclusion
CVE-2025-48865 presents a significant risk to applications using Fabio as a reverse proxy due to its vulnerability in handling HTTP headers. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for github.com/fabiolb/fabio →
FAQ
CVE-2025-48865 is a critical vulnerability in Fabio that allows HTTP clients to manipulate or remove custom headers, potentially leading to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to access control bypass and confusion regarding the source of requests, which may compromise the security of backend applications.
The CVSS score of this vulnerability is 9.1, indicating its critical severity.
If you cannot update immediately, implement additional validation checks on the backend and avoid trusting the X-Forwarded headers for security-sensitive operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fabiolb/fabio.
