CVE-2026-42554
Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.
- CVSS 4.0
- 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-26)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gofiber:fiber
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qjv7-627w-8qjv | Go | github.com/gofiber/fiber/v3 | <3.2.0 | 3.2.0 |
| GHSA-qjv7-627w-8qjv | Go | github.com/gofiber/fiber/v2 | <2.52.13 | 2.52.13 |
| GO-2026-5585 | Go | github.com/gofiber/fiber/v2 | <2.52.13 | 2.52.13 |
| GO-2026-5585 | Go | github.com/gofiber/fiber/v3 | <3.2.0 | 3.2.0 |