Cache Middleware Vulnerability in Fiber Web Framework by Go

CVE-2026-30246

What is CVE-2026-30246?

The Fiber web framework for Go exhibits an issue within its cache middleware where the default key generator relies solely on the request path, neglecting the request's query string. This oversight can lead to different requests that share the same path but contain varying query parameters being assigned the same cache key. Consequently, it could result in incorrect data being returned to users accessing query-dependent endpoints, potentially exposing sensitive information intended for other requests. This flaw has been corrected in versions subsequent to 3.1.0.

References