PT-2026-37036 · Fiber · Fiber

Xeloxa · Published 2026-04-28 · Updated 2026-05-12 · CVE-2026-30246

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions github.com/gofiber/fiber/v3 versions prior to 3.1.0

Description The default key generator in the cache middleware uses only the request path via the c.Path() function and excludes the query string. Consequently, requests targeting the same path but containing different query parameters map to the same cache key. This leads to response mix-ups where a user may receive a cached response intended for a different request, potentially leaking or corrupting user or tenant-specific content for endpoints where the response depends on query parameters.

Recommendations Update to version 3.1.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-524

CWE-436

Related Identifiers

CVE-2026-30246

GHSA-35HP-HQMV-8QG8

Affected Products

Fiber

References · 10

• 🔥 https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8 · Exploit
• https://osv.dev/vulnerability/GHSA-35hp-hqmv-8qg8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30246 · Security Note
• https://github.com/gofiber/fiber/commit/9a0d12c07ed895b84c72987f9288b04137afe5de · Note
• https://github.com/gofiber/fiber · Note
• https://github.com/gofiber/fiber/commit/050ff1ff18511c1475b8ec627460216aaecddd4e · Note
• https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621 · Note
• https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92 · Note
• https://t.me/cveNotify/163208 · Telegram Post
• https://t.me/CVEtracker/52751 · Telegram Post