CVE-2026-53624 Details
Description
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
A vulnerability exists in the Gofiber Fiber web framework, specifically in versions through 3.3.0, within the helmet middleware. The issue arises because the middleware fails to set the Strict-Transport-Security (HSTS) response header, even when HSTSMaxAge is configured. This failure occurs because the middleware checks the HTTP protocol using c.Protocol() instead of c.Scheme(). As a result, the HSTS header is never applied in production, leaving applications vulnerable to SSL stripping attacks and other security risks associated with not enforcing HTTPS.
Users can update to Gofiber Fiber version 3.4.0 or later, where this vulnerability has been fixed. The update corrects the HSTS implementation by using c.Scheme() for HTTPS detection, ensuring that the Strict-Transport-Security header is properly set when HSTSMaxAge is configured.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c | CISA-ADP | ExploitVendor Advisory |
| https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bf | [email protected] | Patch |
| https://github.com/gofiber/fiber/pull/4389 | [email protected] | Issue TrackingPatch |
| https://github.com/gofiber/fiber/releases/tag/v3.4.0 | [email protected] | Release Notes |
| https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gofiber fiber | < 3.4.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |