EUVD-2026-42351
GHSA-gcfq-8gqf-4876
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with forged X-Real-IP header
-
DeliveryGoFiber BalancerForward appends real IP without removing spoofed value
-
ExploitUpstream receives attacker-controlled first X-Real-IP header
-
ExecutionUpstream resolves first header occurrence as authoritative IP
-
ImpactBypass IP-based ACL or rate limit at upstream service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application uses GoFiber's BalancerForward middleware specifically; other GoFiber proxy helpers sharing the same codebase but not calling this function are not affected. The attacker must be able to send arbitrary HTTP request headers to the proxy endpoint, which is the default behavior in any standard HTTP deployment - no special network position is required. Per the CVSS vector (PR:N), no authentication is needed. The practical impact is limited by whether the upstream service actually uses X-Real-IP (rather than X-Forwarded-For or direct TCP source IP) for security-sensitive decisions such as rate limiting, ACL enforcement, or logging. Deployments where upstream services perform no IP-based logic will see no meaningful security impact from this vulnerability. |
| Impact | The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects low complexity and no authentication requirement but conservatively scores integrity impact as Low. Real-world risk is highly context-dependent: in deployments where upstream services use X-Real-IP to gate admin endpoints or apply per-IP throttling, the effective impact is a complete bypass of those controls - materially higher than I:L implies. No EPSS data was provided in the available intelligence, and CISA KEV status is not confirmed, meaning no active exploitation has been established. The attack surface is constrained to applications explicitly using the BalancerForward function; GoFiber deployments using other proxy helpers are not affected by this code path. The CVSS vector is internally consistent with the described behavior and is not contradicted by the description. |
| Exploit ScenarioDerived | An attacker sends an HTTP GET request to a GoFiber BalancerForward proxy with the header X-Real-IP: 10.0.0.1 set to a spoofed internal IP associated with a privileged allow-list. The BalancerForward middleware appends the attacker's real IP as a second X-Real-IP value, forwarding both to the upstream server. The upstream nginx or Express server reads the first X-Real-IP value - the spoofed 10.0.0.1 - and grants the attacker access to an admin panel or API endpoint restricted to the internal 10.0.0.0/8 range, while audit logs record the spoofed address, masking the attacker's true origin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
IP header spoofing in GoFiber's BalancerForward proxy middleware allows any remote unauthenticated attacker to inject a forged X-Real-IP header that upstream servers treat as authoritative. The middleware calls Header.Add() rather than Header.Set() when stamping the real client IP, causing the attacker-supplied value to remain as the first header instance - the one read by nginx, Express, Apache, and most HTTP servers for rate limiting, IP-based ACLs, and audit logging. No public exploit has been identified at time of analysis, but exploitation requires only the ability to set an arbitrary HTTP header, making this trivially accessible to any network attacker targeting deployments using the BalancerForward helper.
RemediationAI
The fix is a one-line change: replace Header.Add("X-Real-IP", c.IP()) with Header.Set("X-Real-IP", c.IP()) at line 282 of middleware/proxy/proxy.go. Header.Set() atomically overwrites all existing X-Real-IP values before writing the real client IP, eliminating the spoofing opportunity. Monitor the GitHub Security Advisory at https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 for a tagged patched release - no specific fix version was confirmed in the available data. As an upstream compensating control, configure each upstream server to unconditionally overwrite the X-Real-IP header using its own observed remote address (for example, in nginx: proxy_set_header X-Real-IP $remote_addr;); this forces the upstream to derive the IP from the TCP connection rather than trust the forwarded header. The trade-off is that this requires changes to every upstream service and eliminates the ability to propagate the original client IP through multi-hop proxy chains.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GoFiber is a Go web framework built atop fasthttp, and its proxy middleware exposes a BalancerForward helper for round-robin load balancing. The root cause (CWE-290, Authentication Bypass by Spoofing) is a single-line misuse of the fasthttp Header API in middleware/proxy/proxy.go at line 282: c.Request().Header.Add("X-Real-IP", c.IP()) appends a new header value without removing any prior value, whereas Header.Set() would atomically replace all existing values for that header name. The HTTP specification permits multiple header instances with the same name; most server-side frameworks resolve this ambiguity by reading the first occurrence, so the attacker-supplied value wins. Affected packages are pkg:go/github.com_gofiber_fiber_v2 and pkg:go/github.com_gofiber_fiber_v3, meaning both major supported release lines are vulnerable.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
No credentials or special conditions needed beyond sending an HTTP header; integrity is Low because only IP-dependent control decisions at upstream are manipulated, not data directly.
Primary rating from Vendor (https://github.com/gofiber/fiber).
CVSS VectorVendor: https://github.com/gofiber/fiber
DescriptionCVE.org
Summary
The BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.
Vulnerable Code
File: middleware/proxy/proxy.go, lines 270-285
func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {
r := &roundrobin{
current: 0,
pool: servers,
}
return func(c fiber.Ctx) error {
server := r.get()
if !strings.HasPrefix(server, "http") {
server = "http://" + server
}
c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set
return Do(c, server+c.OriginalURL(), clients...)
}
}Data Flow
- Attacker sends request with
X-Real-IP: 10.0.0.1(spoofed internal IP) BalancerForwardhandler executes at line 282c.Request().Header.Add("X-Real-IP", c.IP())APPENDS the real IP as a second header- Upstream server receives:
X-Real-IP: 10.0.0.1ANDX-Real-IP: <real-attacker-ip> - Most HTTP servers (nginx, Node.js, Apache) read the FIRST value
- Upstream uses
10.0.0.1for all IP-dependent logic
Impact
- Rate limit bypass: IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests
- IP ACL bypass: Internal IP allowlists (e.g., admin panels restricted to
10.0.0.0/8) can be bypassed - Audit log poisoning: Security logs record the spoofed IP, making incident investigation unreliable
- Geolocation bypass: IP-based geofencing or region restrictions are circumvented
Fix
Replace Header.Add() with Header.Set() at line 282:
c.Request().Header.Set("X-Real-IP", c.IP())Header.Set() replaces any existing header value, ensuring only the real client IP is forwarded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Exploit-DB