CVE-2026-45045: GoFiber X-Real-IP Spoofing Vulnerability in BalancerForward
Summary
CVE-2026-45045: GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward. Affects github.com/gofiber/fiber/v3 versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoFiber is a web framework for Go that is designed to be fast and efficient, providing developers with a simple API for building web applications. It features middleware support, routing, and various utilities to enhance performance. However, a vulnerability exists in the BalancerForward proxy helper, which improperly handles the X-Real-IP header, allowing attackers to spoof their IP addresses.
Vulnerability Detail
The vulnerability arises from the use of Header.Add() instead of Header.Set() in the BalancerForward function. This design flaw allows an attacker to send a request with a spoofed X-Real-IP header, which is then appended rather than replaced. As a result, upstream servers may log the attacker's IP instead of the actual client IP, leading to potential security issues such as rate limit bypass, IP ACL bypass, audit log poisoning, and geolocation bypass.
How To Fix
Latest published version: v3.6.1 as of 22 Oct 2026
go get github.com/gofiber/fiber/v3@v3.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.0
This is the first release that contains the fix.
go get github.com/gofiber/fiber/v3@v3.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing a reverse proxy configuration that correctly handles the X-Real-IP header or use additional security measures to validate incoming requests.
Conclusion
The GoFiber framework has a vulnerability in its BalancerForward function that allows for X-Real-IP spoofing. It is crucial to update to the patched version and modify the code to prevent potential security risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/gofiber/fiber/v3 →
FAQ
The vulnerability can lead to rate limit bypass, IP ACL bypass, audit log poisoning, and geolocation bypass, compromising the security of the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of GoFiber up to 3.2.0 for v3 and up to 2.52.13 for v2 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and implement best security practices in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber/v3.
