VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gofiber/fiber: vulnerability history, versions and safety

github.com/gofiber/fiber is a package in the Go ecosystem. Vulert records 10 vulnerabilities for it across 120 releases, from Apr 2021 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
10 vulnerabilities recorded C1 M3 U6
i
4 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 06 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gofiber/fiber vulnerabilities

Vulert verdict on github.com/gofiber/fiber v1.14.6 i

Updated on 23 Oct 2026

Careful: v1.14.6 has 10 known vulnerabilities, and 4 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.14.6 — affected i
  • Vulnerabilities on record 10 over 5 years · 2 in the last year i
  • Latest disclosure 06 Jul 2026 i
  • Highest CVSS 10.0 i
  • With no published fix 4 i
  • Stars 40,230 i
  • OpenSSF scorecard 6/10 i
  • Last release 73 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gofiber/fiber, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.9.7-0.20210420064632-8e92125b203e 20 Apr 2021 C1 M3 U6 — No Details →
v0.0.0-20200911185602-755b75f6f854 11 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6 11 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6-0.20200911184110-67ae8e7e69ca 11 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200911184032-612c8491effb 11 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200911031723-f94307b2a2c4 11 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200910140511-b4dea7272078 10 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200910003046-44511cfcabbb 10 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200909141631-037d1bea14f3 09 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200908141202-5acda4944c05 08 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200908022242-0b8785f8d91d 08 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200906170711-61d88c6b65e8 06 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200906132618-49b637bd3194 06 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200905033657-036922429426 05 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200903170336-1084e3c7cf70 03 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6-0.20200902215952-29e8f12a1396 02 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200902190217-225b5743546b 02 Sep 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200902185942-ad7f4df9a771 02 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6-0.20200901191732-733da0915c69 01 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6-0.20200901185555-ba67152ceaa4 01 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.6-0.20200901181329-f1a9d65c100b 01 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.5 01 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200901123143-11fdb537d10b 01 Sep 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200831115726-1920d486a2e1 31 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200828093658-b4feb5ff1a79 28 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200827172251-cf3a57e3c57b 27 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200827172239-896cbc481fc2 27 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.5-0.20200827172111-7f542d035334 27 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.4 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200824085716-4085a53d784e 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.4-0.20200824085636-0c6a9de0de31 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200824085614-37158a1e1515 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.4-0.20200824085214-3884d5ecc1ed 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200824083512-f3359f439a32 24 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200816104816-5ee927d5c532 16 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.3-0.20200816104449-9855d1de0c22 16 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.2 16 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.0 14 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200814150137-e98a1b1bb367 14 Aug 2020 C1 M3 U6 MIT No Details →
v1.14.1 14 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200813005727-cc777f2e7808 13 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810221224-bfbb0273e83d 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810220804-cec3629ecba8 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810220200-2ce81c18359a 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810215647-5108d2b3b307 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810215616-254bc3059606 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810145603-5b2ade2fee9c 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810145214-bd483b784e92 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810143721-0d31dc193c23 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810085441-2c6d7e00c49d 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810085138-df3c48a7341d 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810081431-e802c41f4148 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810081417-053d463fa6c2 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200810075053-67caca823bae 10 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200809200514-cff454dfc2d1 09 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200809195315-945b61d1c3f1 09 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200809175010-d9c09fa68efb 09 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200808004820-6ca4fe500f63 08 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200807194253-b8ca4c9b8ad2 07 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200807124153-30081db4fa2f 07 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200807123840-2283fd27567b 07 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200806004358-582b10a6d4f5 06 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200806003947-8c4f346a335e 06 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200806003605-a1148391ea4e 06 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200801101450-1a89b6197696 01 Aug 2020 C1 M3 U6 MIT No Details →
v1.9.7-0.20200801101450-1a89b6197696 01 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200801053855-d18689558e3f 01 Aug 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200731232701-d38419ebbc2c 31 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200731145650-ebb5173c197b 31 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200731120536-99a10999debb 31 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200731120137-797fe3a8e5de 31 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729145221-73d310e81de2 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729144942-5605c7916fad 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729144253-9ac4c160fdd3 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729143743-878764d0649a 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729140549-8950e94a4d88 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729071849-96b571165a10 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729065551-e47341ac5d55 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729065213-0d4b3c4c27a8 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729064217-76c67ca05a38 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729050833-dd33a797726e 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729032927-9cac73e7bad2 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729030747-7863cd145883 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729020347-5ee5418b36e3 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729011415-377972350722 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200729004636-d15aae1e5666 29 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200728084805-c460cba7293d 28 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200728040631-616ebec453dc 28 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200728040352-1ee7f62c351b 28 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200728024012-206d3a5aba21 28 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200728023656-87127f571adc 28 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727024319-d06256c944bb 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727023910-aafd222eaf27 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727020345-931df73503d4 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727015557-b310f0f50112 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727015547-affd3469ba3a 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200727015326-fc85699a9506 27 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200726053638-49d6d04daf86 26 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200726053543-fd75ef0fbe39 26 Jul 2020 C1 M3 U6 MIT No Details →
v1.13.4-0.20200724152826-415a6026c14d 24 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200724152542-fa6b8ea65944 24 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200724145557-cf22aa2ae570 24 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200724135308-4ebd887faa64 24 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723042933-c2f552d92efe 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723042918-205a4ef0332f 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723042116-f852f08939a7 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723041222-9f05f79c2f0c 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723040909-ff2e918b95cf 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723040759-c22e7890dd7d 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.3-0.20200723040750-6fa694463181 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200723040654-9fc96024fa22 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.3-0.20200723040612-0e7b9dacb141 23 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200722163033-74a036e5720c 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.3-0.20200722160459-5d9cbba46787 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200722145503-15c3ecf3cac1 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200722145349-aacfb619747b 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200722025558-62e933bd2af5 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.4-0.20200722025002-43dd0c3b5dbb 22 Jul 2020 C1 M3 U6 — No Details →
v1.13.3 22 Jul 2020 C1 M3 U6 — No Details →

The newest 120 of 2,065 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 4
  • 2023 1
  • 2024 2
  • 2025 1
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 10 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gofiber/fiber

The 5 most severe of 10 vulnerabilities recorded for this package

Search all 10 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-38513: Session Middleware Token Injection Vulnerability in GoFiber 10.0 critical 2.52.5 01 Jul 2024
Fiber Unauthorized Access Vulnerability in github.com/gofiber/fiber 5.3 medium No fix published 08 Sep 2023
CVE-2026-53624: GoFiber Helmet Middleware HSTS Header Not Set Due to Protocol Check Error 4.8 medium 3.4.0 06 Jul 2026
CVE-2020-15111: CRLF vulnerability in Fiber 4.2 medium 1.12.6 29 Jun 2021
CVE-2020-15111: CRLF vulnerability in github.com/gofiber/fiber N/A unrated 1.12.6 28 Jul 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gofiber/fiber

Is github.com/gofiber/fiber safe to use?

Vulert records 10 vulnerabilities for github.com/gofiber/fiber in Go: 1 critical, 0 high, 3 medium and 0 low, plus 6 not yet rated. 4 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/gofiber/fiber's Vulert package health score?

Vulert scores github.com/gofiber/fiber 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/gofiber/fiber affected?

Yes. v1.14.6, the version you would install today, has 10 known vulnerabilities, and 4 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/gofiber/fiber have?

10 vulnerabilities are recorded for github.com/gofiber/fiber in the Go ecosystem: 1 critical, 0 high, 3 medium and 0 low, plus 6 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gofiber/fiber vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/gofiber/fiber in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gofiber/fiber are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gofiber/fiber for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gofiber/fiber version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.