CVE-2020-15111: CRLF vulnerability in github.com/gofiber/fiber
Summary
CVE-2020-15111: CRLF vulnerability in Fiber in github.com/gofiber/fiber. Affects github.com/gofiber/fiber versions < 1.12.6. Fixed in 1.12.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is github.com/gofiber/fiber, which is a Go web framework built to facilitate the development of high-performance web applications. It provides a lightweight and efficient routing mechanism, middleware support, and various other features to simplify web development. However, this package is vulnerable to a CRLF (Carriage Return Line Feed) vulnerability, which can lead to the injection of additional headers into an HTTP response and the use of an attacker-controlled filename during file downloads.
Vulnerability Detail
The CRLF vulnerability in github.com/gofiber/fiber arises due to improper input sanitization. An attacker can exploit this vulnerability by constructing a malicious filename that includes CRLF characters. When a user attempts to download a file with the manipulated filename, the server may use the attacker-controlled filename instead. Additionally, the attacker can inject additional headers into the HTTP response, potentially leading to further attacks or unauthorized access. This vulnerability can have severe ramifications, including the potential for information disclosure, unauthorized file downloads, and manipulation of HTTP responses.
How To Fix
Latest published version: v1.14.6 as of 22 Oct 2026
go get github.com/gofiber/fiber@v1.14.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.6
This is the first release that contains the fix.
go get github.com/gofiber/fiber@v1.12.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by implementing their own input sanitization mechanisms to prevent CRLF injection. This can involve validating and sanitizing user input before using it in file downloads or HTTP responses. It is crucial to ensure that any user-supplied data is properly sanitized and does not contain any CRLF characters that could be exploited by attackers.
Conclusion
In conclusion, the github.com/gofiber/fiber package is vulnerable to a CRLF vulnerability that can lead to unauthorized file downloads, manipulation of HTTP responses, and potential information disclosure. It is crucial to update to version 1.12.6 or later to patch the vulnerability and ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/gofiber/fiber →
FAQ
This vulnerability can lead to unauthorized file downloads, manipulation of HTTP responses, and potential information disclosure. Attackers can exploit the CRLF vulnerability to inject additional headers into HTTP responses and use attacker-controlled filenames during file downloads.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file. It provides an easy way to assess the impact of vulnerabilities without requiring access to the code or installation.
While specific exploits for this vulnerability may not be publicly disclosed, the CRLF vulnerability can be leveraged by attackers to perform various attacks, such as injecting malicious headers, conducting phishing attacks, or manipulating file downloads. It is crucial to patch the vulnerability to prevent potential exploitation.
Yes, the developers of github.com/gofiber/fiber have addressed this vulnerability in version 1.12.6. It is recommended to update to the latest version to ensure that the vulnerability is patched and the application is secure.
If you have an older version of github.com/gofiber/fiber, it is crucial to update to version 1.12.6 or later. Updating to the latest version will ensure that the vulnerability is patched and the application is secure. Make sure to follow the update instructions provided by the package maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
