CVE-2020-15111: Arbitrary HTTP Header Injection in github.com/gofiber/fiber
Summary
GO-2021-0091: Due to improper input validation when uploading a file, a malicious user may force the server to return arbitrary HTTP headers when the uploaded file is downloaded. Affects github.com/gofiber/fiber versions < 1.12.6-0.20200710202935-a8ad5454363f. Fixed in 1.12.6-0.20200710202935-a8ad5454363f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/gofiber/fiber is a Go package that provides an Express.js-inspired web framework for building fast and efficient web applications. It offers various features such as routing, middleware support, and request/response handling. However, a vulnerability has been identified in the package that allows a malicious user to manipulate the server to return arbitrary HTTP headers when a specific file is downloaded.
Vulnerability Detail
The vulnerability arises due to improper input validation when uploading a file. By exploiting this flaw, an attacker can inject arbitrary HTTP headers into the server's response when the targeted file is downloaded. This can lead to various security issues, such as HTTP response splitting attacks, cache poisoning, and cross-site scripting (XSS) attacks. It is important to note that this vulnerability affects versions 0 through 1.12.6-0.20200710202935-a8ad5454363f of the github.com/gofiber/fiber package.
How To Fix
Latest published version: v1.14.6 as of 22 Oct 2026
go get github.com/gofiber/fiber@v1.14.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.6-0.20200710202935-a8ad5454363f
This is the first release that contains the fix.
go get github.com/gofiber/fiber@v1.12.6-0.20200710202935-a8ad5454363fTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability in github.com/gofiber/fiber allows an attacker to inject arbitrary HTTP headers into the server's response when a specific file is downloaded. This can lead to various security risks, including HTTP response splitting, cache poisoning, and XSS attacks. It is crucial for developers to update their applications to the fixed version of the package (1.12.6-0.20200710202935-a8ad5454363f) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gofiber/fiber →
FAQ
This vulnerability allows an attacker to manipulate the server's response and potentially perform various attacks, including HTTP response splitting, cache poisoning, and XSS attacks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, all versions from 0 through 1.12.6-0.20200710202935-a8ad5454363f are vulnerable to this issue. It is crucial to update to the fixed version to mitigate the risk.
Yes, the fixed version of github.com/gofiber/fiber is 1.12.6-0.20200710202935-a8ad5454363f. Developers should update their applications to this version to address the vulnerability.
Yes, this vulnerability can be exploited remotely by sending a specially crafted file upload request to the server.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber.
