Web Framework Vulnerability in Fiber by GoFiber

CVE-2026-53624

What is CVE-2026-53624?

The Fiber web framework, crafted in Go, has a flaw in its helmet middleware that affects the handling of the Strict-Transport-Security (HSTS) header. In versions prior to 3.4.0, the framework fails to appropriately set the HSTS response header due to a misconfiguration in the protocol check, which utilizes the 'c.Protocol()' method instead of the more accurate 'c.Scheme()'. This discrepancy can lead to security risks, as it exposes applications to potential man-in-the-middle attacks and undermines the intended security posture of the web application. The issue has been rectified in version 3.4.0.

References