Cross-Site Scripting Flaw in Go Fiber Framework

CVE-2026-42554

What is CVE-2026-42554?

A Cross-Site Scripting (XSS) vulnerability exists in the Go Fiber web framework, which allows remote attackers to inject arbitrary HTML or JavaScript code. This occurs when the 'Accept: text/html' header is supplied in requests to handlers that pass attacker-controlled data to the AutoFormat() feature. The flaw arises because the developer may not explicitly opt out of raw HTML emission in certain requests. As a result, under specific conditions, an attacker can manipulate the content negotiation process and exploit the inherent design flaw of AutoFormat(). The issue has been resolved in versions 2.52.12 and 3.1.0.

References