CVE-2026-30246: Fiber v3 Cache Middleware Query String Ignored Leading to Response Mix-Up
Summary
CVE-2026-30246: Fiber cache middleware's default key generator uses only c.Path() and does not include the query string. Affects github.com/gofiber/fiber/v3 versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fiber is a web framework for Go that is designed to be fast and efficient. It provides a range of middleware options to enhance functionality, including caching middleware that improves performance by storing responses. However, a vulnerability has been identified in the cache middleware's default key generator, which only considers the request path and ignores query strings, leading to potential response mix-ups.
Vulnerability Detail
The vulnerability arises from the default key generator in Fiber's cache middleware, which uses only the request path (c.Path()) to generate cache keys. This means that requests with different query parameters can inadvertently share the same cache key, resulting in a scenario where a response intended for one query parameter is returned for another. For example, a request to '/?id=1' and another to '/?id=2' could both return the cached response for the first request, leading to incorrect data being served to users. This behavior can lead to cache poisoning and may expose sensitive information or corrupt user-specific content, depending on the application’s context.
How To Fix
Latest published version: v3.6.1 as of 22 Oct 2026
go get github.com/gofiber/fiber/v3@v3.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
go get github.com/gofiber/fiber/v3@v3.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, you can implement a custom key generator in your cache middleware configuration to include the query string. Here’s an example of how to do this:
app.Use(cache.New(cache.Config{
KeyGenerator: func(c fiber.Ctx) string {
return utils.CopyString(c.Path() + c.QueryString())
},
}))
Conclusion
The vulnerability in Fiber's cache middleware highlights the importance of considering all aspects of a request when generating cache keys. By updating to the latest version or implementing a custom key generator, developers can mitigate the risks associated with this issue and ensure that their applications serve the correct responses.
See every vulnerability recorded for github.com/gofiber/fiber/v3 →
FAQ
The vulnerability allows different requests with distinct query parameters to share the same cached response, leading to potential data exposure or corruption.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup required.
The impacts include serving incorrect responses to users, which can lead to data leaks or corruption, especially in applications where query parameters influence the response content.
Yes, the vulnerability has been patched in Fiber version 3.2.0. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber/v3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
