CVE-2025-48865: Custom Header Manipulation Vulnerability in Fabio
Summary
CVE-2025-48865: Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio. Affects github.com/fabiolb/fabio versions < 1.6.6. Fixed in 1.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fabio is an open-source load balancer and reverse proxy for HTTP and TCP applications. It is designed to route traffic to various backend services based on dynamic configurations. Fabio's key features include service discovery, load balancing, and support for custom routing rules. However, it has a vulnerability that allows HTTP clients to manipulate custom headers, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability arises from Fabio's handling of custom headers, which can be manipulated by HTTP clients. This manipulation can lead to unintended behavior in the application, such as bypassing security controls or altering the intended routing of requests. The issue is particularly concerning as it may allow attackers to exploit the application by injecting malicious headers, which could compromise the integrity and confidentiality of the data being processed.
How To Fix
Latest published version: v1.8.0 as of 23 Oct 2026
go get github.com/fabiolb/fabio@v1.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.6
This is the first release that contains the fix.
go get github.com/fabiolb/fabio@v1.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict validation of incoming headers in your application to prevent unauthorized manipulation. This can be done by checking the headers against a whitelist of allowed values before processing requests.
Conclusion
The CVE-2025-48865 vulnerability in Fabio allows for the manipulation of custom headers by HTTP clients, posing significant security risks. It is crucial to update to version 1.6.6 or later to mitigate this vulnerability. Implementing strict header validation can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for github.com/fabiolb/fabio →
FAQ
CVE-2025-48865 is a vulnerability in the Fabio load balancer that allows HTTP clients to manipulate custom headers, potentially leading to security issues.
If your application uses Fabio and does not implement proper header validation, it may be susceptible to unauthorized access or data manipulation.
If you cannot update, implement strict header validation as a temporary workaround to mitigate the risk of exploitation.
You can find more details on the vulnerability at the Go vulnerability database: https://pkg.go.dev/vuln/GO-2025-3722.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application against vulnerabilities using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fabiolb/fabio.
