CVE-2026-53624

EUVD-2026-42356
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.66%
Affected Products (NVD)
VendorProductVersion
gofiberfiber
𝑥
< 3.4.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-github-gofiber-fiber
jammy
dne
noble
dne
questing
dne
resolute
dne
golang-github-gofiber-fiber-v2
jammy
dne
noble
dne
questing
dne
resolute
dne
Common Weakness Enumeration
References
https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bf
https://github.com/gofiber/fiber/pull/4389
https://github.com/gofiber/fiber/releases/tag/v3.4.0
https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c
https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c