What is the CVSS score of EUVD-2026-42351?

EUVD-2026-42351 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-42351?

Yes, a patch is available for EUVD-2026-42351. Update the affected software to the latest version immediately.

GoFiber EUVD-2026-42351

| CVE-2026-45045 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-02 https://github.com/gofiber/fiber

GHSA-gcfq-8gqf-4876

Authentication Bypass Nginx Node.js Apache Suse

5.3

CVSS 3.1 · Vendor: https://github.com/gofiber/fiber

Severity by source

Vendor (https://github.com/gofiber/fiber) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

No credentials or special conditions needed beyond sending an HTTP header; integrity is Low because only IP-dependent control decisions at upstream are manipulated, not data directly.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (https://github.com/gofiber/fiber).

CVSS VectorVendor: https://github.com/gofiber/fiber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 15:01 vuln.today

CVE Published

Jul 02, 2026 - 13:50 github-advisory

MEDIUM 5.3

DescriptionCVE.org

Summary

The BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.

Vulnerable Code

File: middleware/proxy/proxy.go, lines 270-285

func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {
    r := &roundrobin{
        current: 0,
        pool:    servers,
    }
    return func(c fiber.Ctx) error {
        server := r.get()
        if !strings.HasPrefix(server, "http") {
            server = "http://" + server
        }
        c.Request().Header.Add("X-Real-IP", c.IP())   // line 282: Add, not Set
        return Do(c, server+c.OriginalURL(), clients...)
    }
}

Data Flow

Attacker sends request with X-Real-IP: 10.0.0.1 (spoofed internal IP)
BalancerForward handler executes at line 282
c.Request().Header.Add("X-Real-IP", c.IP()) APPENDS the real IP as a second header
Upstream server receives: X-Real-IP: 10.0.0.1 AND X-Real-IP: <real-attacker-ip>
Most HTTP servers (nginx, Node.js, Apache) read the FIRST value
Upstream uses 10.0.0.1 for all IP-dependent logic

Impact

Rate limit bypass: IP-based rate limiting at the upstream uses the spoofed IP, allowing unlimited requests
IP ACL bypass: Internal IP allowlists (e.g., admin panels restricted to 10.0.0.0/8) can be bypassed
Audit log poisoning: Security logs record the spoofed IP, making incident investigation unreliable
Geolocation bypass: IP-based geofencing or region restrictions are circumvented

Fix

Replace Header.Add() with Header.Set() at line 282:

c.Request().Header.Set("X-Real-IP", c.IP())

Header.Set() replaces any existing header value, ensuring only the real client IP is forwarded.

AnalysisAI

IP header spoofing in GoFiber's BalancerForward proxy middleware allows any remote unauthenticated attacker to inject a forged X-Real-IP header that upstream servers treat as authoritative. The middleware calls Header.Add() rather than Header.Set() when stamping the real client IP, causing the attacker-supplied value to remain as the first header instance - the one read by nginx, Express, Apache, and most HTTP servers for rate limiting, IP-based ACLs, and audit logging. No public exploit has been identified at time of analysis, but exploitation requires only the ability to set an arbitrary HTTP header, making this trivially accessible to any network attacker targeting deployments using the BalancerForward helper.

Technical ContextAI

GoFiber is a Go web framework built atop fasthttp, and its proxy middleware exposes a BalancerForward helper for round-robin load balancing. The root cause (CWE-290, Authentication Bypass by Spoofing) is a single-line misuse of the fasthttp Header API in middleware/proxy/proxy.go at line 282: c.Request().Header.Add("X-Real-IP", c.IP()) appends a new header value without removing any prior value, whereas Header.Set() would atomically replace all existing values for that header name. The HTTP specification permits multiple header instances with the same name; most server-side frameworks resolve this ambiguity by reading the first occurrence, so the attacker-supplied value wins. Affected packages are pkg:go/github.com_gofiber_fiber_v2 and pkg:go/github.com_gofiber_fiber_v3, meaning both major supported release lines are vulnerable.

RemediationAI

The fix is a one-line change: replace Header.Add("X-Real-IP", c.IP()) with Header.Set("X-Real-IP", c.IP()) at line 282 of middleware/proxy/proxy.go. Header.Set() atomically overwrites all existing X-Real-IP values before writing the real client IP, eliminating the spoofing opportunity. Monitor the GitHub Security Advisory at https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 for a tagged patched release - no specific fix version was confirmed in the available data. As an upstream compensating control, configure each upstream server to unconditionally overwrite the X-Real-IP header using its own observed remote address (for example, in nginx: proxy_set_header X-Real-IP $remote_addr;); this forces the upstream to derive the IP from the TCP connection rather than trust the forwarded header. The trade-off is that this requires changes to every upstream service and eliminates the ability to propagate the original client IP through multi-hop proxy chains.