VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gofiber/fiber/v3: vulnerability history, versions and safety

github.com/gofiber/fiber/v3 is a package in the Go ecosystem. Vulert records 12 vulnerabilities for it across 120 releases, from Feb 2026 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
12 vulnerabilities recorded H2 M4 U6
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
12 in the last 12 months

Most recent disclosure 24 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gofiber/fiber/v3 vulnerabilities

Vulert verdict on github.com/gofiber/fiber/v3 v3.6.1 i

Updated on 23 Oct 2026

Action needed: v3.6.1 has 12 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 72/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v3.6.1 — affected i
  • Vulnerabilities on record 12 over 1 year · 12 in the last year i
  • Latest disclosure 24 Jul 2026 i
  • Highest CVSS 8.7 i
  • With no published fix 0 i
  • Stars 40,230 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gofiber/fiber/v3, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v3.6.2-0.20261021063903-9122a279a5f0 21 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261020133752-4c6841b35953 20 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261020092301-9bd57df6e9ab 20 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261019125855-45156761f9c6 19 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261017162352-40be9a581e77 17 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261015101833-c003155f804b 15 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.2-0.20261015092534-a1ac5133c60c 15 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.1 14 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.1-0.20261014074110-9d6d7b669ce2 14 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.1-0.20261013113323-663afc94dbbc 13 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.6.0 12 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261010062620-0f2e61f25896 10 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261009125858-56cd561f7d57 09 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261009061954-44e30a1bca01 09 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008143908-014cfa68cbbf 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008133610-6bd5c5f76e39 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008094510-7781a99f010f 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008063717-662b30d1bef2 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008063621-a0d0840846d8 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261008063529-cefb0f54b4a2 08 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261007125913-ced6bfa8b691 07 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261005132915-d21a7201b2c1 05 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261003182653-78b8ee93c988 03 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20261001183925-0923873f4a1b 01 Oct 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260930134122-2e4049833052 30 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260930125914-7ccaa6b68414 30 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260930111054-11954d103387 30 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260929111448-ae1ef46ff2cc 29 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260928124232-7c56c53bb2ea 28 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260925182002-e10bca7375d8 25 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260924145711-d0a059d0d748 24 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260922102119-aadd456b8335 22 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260921151004-4e1fce79a6b3 21 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260917125705-e90c824775a0 17 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260916133055-0deabbe15a71 16 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260916111451-9f1eda6b315f 16 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260916061341-255b89cd10c9 16 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260915132512-9d417a3cad7a 15 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260914184946-f128422199fe 14 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260914150341-1f121ad2aac6 14 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260914125923-4f275c9f4a40 14 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260912143331-ea98ecc75c44 12 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260910125904-ef013fa52a24 10 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260909150030-6cb9479e7072 09 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260908125501-7c73f8290a5c 08 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260907141705-f73d37fb732f 07 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260906163740-d8c8f85b4173 06 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260905183818-bd6071b4b60c 05 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260905172511-ac861c5aa3f9 05 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260905170444-98473ec781bc 05 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260904084928-1783fe81ac62 04 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260902184839-0c5108d00e9e 02 Sep 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260831125753-bd83fb46e30e 31 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260828125854-e7229b1b3ead 28 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260827131651-a9981a7db37d 27 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260825190841-3ca9a9d5d118 25 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260825123933-0e3313f81a6a 25 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260825103559-c2f0fe099923 25 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260824125950-85d390cbd852 24 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260823160137-cfd2a99d5d59 23 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260821112503-c344047e1028 21 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260820125855-18cd0b3a3cd5 20 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260819115416-fec5891c1843 19 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260818125919-5724f8720f84 18 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260817125653-859d6c5e6174 17 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.1-0.20260814165916-d3085b5ed68a 14 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260812150915-741d8511a75f 12 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.5.0 12 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260812061746-9da941fe571b 12 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260811090218-a105acad6c1e 11 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260806122800-a2a6d290f4a1 06 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260805125713-3f590102d18d 05 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260804114008-9a4c7e57fe0b 04 Aug 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260729133738-bf38665817c3 29 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260728224340-6955385b9a19 28 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260728213806-5405fafd63bd 28 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260728075428-722faf570327 28 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260727145115-ef68646f4a5d 27 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260724162430-84ecfab14184 24 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260717063427-981cf15e6a50 17 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260714135216-c98473feb558 14 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260711215416-21cd641e5e8e 11 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260710133433-f28056984f72 10 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260708135715-d1e48af2a5cf 08 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260705193202-b8db335caea8 05 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.1-0.20260703082906-adef0e856c22 03 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.4.0 02 Jul 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260630061406-e0edc7d384f7 30 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260628162008-0ca0741abec3 28 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260628122423-e7ac90c57eb5 28 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.0.0-20260622081132-9c236aa59e1d 22 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260622081132-9c236aa59e1d 22 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260619075546-5de21e9f395b 19 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260615102121-15d2dc608b7c 15 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260614192159-c6d692c652d9 14 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260611125656-811dbc9f420d 11 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260610220334-df8e39030b3a 10 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260606202701-60e53a3aff4a 06 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260602124757-57cf8d2ff78c 02 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.0.0-20260601144126-c34e5b8e304f 01 Jun 2026 H2 M4 U6 MIT Yes Details →
v3.3.1-0.20260601144126-c34e5b8e304f 01 Jun 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260601140153-cdd84c414b31 01 Jun 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260529200806-ee98695ff8e0 29 May 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260529064021-9a480eff31a5 29 May 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260527144235-62d9d2574524 27 May 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260525185816-e5e93e6812bc 25 May 2026 H2 M4 U6 — Yes Details →
v3.3.1-0.20260523154812-000ca396c93e 23 May 2026 H2 M4 U6 — Yes Details →
v3.3.0 22 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260519234021-a86f3833216e 19 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260518133507-dfc64f56c923 18 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260512185328-33b7fd4718f7 12 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260509181940-30b1caacdd0f 09 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260508125743-19337c9e88e3 08 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260508071008-1403cc8292da 08 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260507060459-40c0a5279ab1 07 May 2026 H2 M4 U6 — Yes Details →
v3.0.0-20260506125730-d5c49b2fdef9 06 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260506125730-d5c49b2fdef9 06 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260505125707-7bfb06a37773 05 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260503121112-3e610aedaa99 03 May 2026 H2 M4 U6 — Yes Details →
v3.2.1-0.20260429125610-48a32e76bc43 29 Apr 2026 H2 M4 U6 — Yes Details →

The newest 120 of 638 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 12

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 12 of the 12 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gofiber/fiber/v3

The 5 most severe of 12 vulnerabilities recorded for this package

Search all 12 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-25891: Fiber Package Arbitrary File Read Vulnerability on Windows 8.7 high 3.1.0 24 Feb 2026
CVE-2026-25899: GoFiber Package Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation 7.5 high 3.1.0 24 Feb 2026
CVE-2026-30246: Fiber v3 Cache Middleware Query String Ignored Leading to Response Mix-Up 6.5 medium 3.2.0 28 Apr 2026
CVE-2026-45045: GoFiber X-Real-IP Spoofing Vulnerability in BalancerForward 5.3 medium 3.3.0 02 Jul 2026
CVE-2026-44332: GoFiber BasicAuth Middleware Vulnerable to Username Enumeration via Timing Oracle 5.3 medium 3.3.0 02 Jul 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gofiber/fiber/v3

Is github.com/gofiber/fiber/v3 safe to use?

Vulert records 12 vulnerabilities for github.com/gofiber/fiber/v3 in Go: 0 critical, 2 high, 4 medium and 0 low, plus 6 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/gofiber/fiber/v3's Vulert package health score?

Vulert scores github.com/gofiber/fiber/v3 72/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/gofiber/fiber/v3 affected?

Yes. v3.6.1, the version you would install today, has 12 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/gofiber/fiber/v3 have?

12 vulnerabilities are recorded for github.com/gofiber/fiber/v3 in the Go ecosystem: 0 critical, 2 high, 4 medium and 0 low, plus 6 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gofiber/fiber/v3 vulnerabilities disclosed?

12 vulnerabilities were recorded for github.com/gofiber/fiber/v3 in the last 12 months, and the oldest entry in this database dates to 24 Feb 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gofiber/fiber/v3 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gofiber/fiber/v3 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gofiber/fiber/v3 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.