Proxy Injection Vulnerability in Go-Based Fiber Framework
CVE-2026-45045
5.3MEDIUM
What is CVE-2026-45045?
A vulnerability in the Fiber web framework allows an attacker to manipulate the X-Real-IP header through the BalancerForward proxy helper. This occurs because the framework incorrectly uses Header.Add() instead of Header.Set(), resulting in the potential misuse of the first X-Real-IP value supplied by an attacker. This flaw can affect how applications log user IPs, enforce rate limits, and implement access controls. It is essential to upgrade to the patched versions 3.3.0 or 2.52.14 to mitigate this issue.
Affected Version(s)
fiber >= 3.0.0-beta.2, < 3.3.0 < 3.0.0-beta.2, 3.3.0
fiber < 2.52.14 < 2.52.14