CVE-2026-42554 Details
Description
Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.
A Cross-Site Scripting (CWE-79) vulnerability exists in the Go Fiber web framework, specifically in versions of the 'fiber' package prior to 2.52.12 and 3.1.0. The vulnerability allows remote attackers to inject arbitrary HTML or JavaScript by sending an 'Accept: text/html' header on requests that are processed by the AutoFormat() feature. This issue arises because the framework improperly handles content negotiation, allowing attackers to exploit developer-intended data formatting functions to inject malicious scripts. The vulnerability is present in 'DefaultRes.AutoFormat' for Fiber v3 through 3.1.0 and in 'Ctx.Format' for Fiber v2 through 2.52.12.
Users can upgrade to Go Fiber versions 2.52.12 or 3.1.0 and later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gofiber fiber | < 2.52.12 >= 3.0.0, < 3.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |