CVE-2026-30246 Details

A cache key generation vulnerability has been identified in the Fiber web framework for Go, specifically in versions through 3.1.0. The issue arises in the cache middleware, where the default key generator relies solely on the request path, excluding the query string. This oversight allows requests with identical paths but different query parameters to share a cache key, leading to incorrect cached responses. Such a flaw can cause response mix-ups for endpoints sensitive to query parameters, potentially exposing data meant for different requests.

Users can update to Fiber version 3.1.1 or later, where this vulnerability is fixed. Additionally, for those using the cache middleware, it's recommended to set a custom key generator that includes the query string or to use a version of Fiber that has this issue addressed.