{"items":[{"id":"NVI-00015177","kind":"vulnerability","title":"GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-gcfq-8gqf-4876","CVE-2026-45045"],"plain_summary":"GitHub lists this reviewed advisory for github.com/gofiber/fiber/v3, github.com/gofiber/fiber/v2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-334f9a2a4e7c7c20085942fe2ea5aaa5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-04T21:52:04.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-364880d3ea9ff98223817ed7b1404092"},{"kind":"CVSS","as_of":"2026-10-25T17:10:00.197Z","value":"5.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-334f9a2a4e7c7c20085942fe2ea5aaa5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-364880d3ea9ff98223817ed7b1404092","url":"https://github.com/advisories/GHSA-gcfq-8gqf-4876","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gcfq-8gqf-4876","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:09.980Z"},{"id":"sr-334f9a2a4e7c7c20085942fe2ea5aaa5","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45045","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-45045","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:47:29.046Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-364880d3ea9ff98223817ed7b1404092"],"technology":"github.com/gofiber/fiber/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.\n\n## Vulnerable Code\n\n**File:** `middleware/proxy/proxy.go`, lines 270-285\n\n```go\nfunc BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {\n    r := &roundrobin{\n        current: 0,\n        pool:    servers,\n    }\n    return func(c fiber.Ctx) error {\n        server := r.get()\n        if !strings.HasPrefix(server, \"http\") {\n            server = \"http://\" + server\n        }\n        c.Request().Header.Add(\"X-Real-IP\", c.IP())   // line 282: Add, not Set\n        return Do(c, server+c.OriginalURL(), clients...)\n    }\n}\n```\n\n## Data Flow\n\n1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP)\n2. `BalancerForward` handler executes at line 282\n3. `c.Request().Header.Add(\"X-Real-IP\", c.IP())` APPENDS the real IP as a second header\n4.","public_affected_ranges":["<= 3.2.0"]},{"certainty":"source_listed","source_ids":["sr-364880d3ea9ff98223817ed7b1404092"],"technology":"github.com/gofiber/fiber/v2","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.\n\n## Vulnerable Code\n\n**File:** `middleware/proxy/proxy.go`, lines 270-285\n\n```go\nfunc BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {\n    r := &roundrobin{\n        current: 0,\n        pool:    servers,\n    }\n    return func(c fiber.Ctx) error {\n        server := r.get()\n        if !strings.HasPrefix(server, \"http\") {\n            server = \"http://\" + server\n        }\n        c.Request().Header.Add(\"X-Real-IP\", c.IP())   // line 282: Add, not Set\n        return Do(c, server+c.OriginalURL(), clients...)\n    }\n}\n```\n\n## Data Flow\n\n1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP)\n2. `BalancerForward` handler executes at line 282\n3. `c.Request().Header.Add(\"X-Real-IP\", c.IP())` APPENDS the real IP as a second header\n4.","public_affected_ranges":["<= 2.52.13"]}],"null_published_at":"2026-11-08T19:53:44.047Z","source_updated_at":"2026-08-04T21:52:04.000Z","source_disclosed_at":"2026-07-02T13:50:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T09:58:09.980Z"},{"id":"NVI-00015177","kind":"vulnerability","title":"GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gcfq-8gqf-4876","CVE-2026-45045"],"plain_summary":"GitHub lists this reviewed advisory for github.com/gofiber/fiber/v3, github.com/gofiber/fiber/v2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-364880d3ea9ff98223817ed7b1404092"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-04T21:52:04.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-364880d3ea9ff98223817ed7b1404092"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-364880d3ea9ff98223817ed7b1404092","url":"https://github.com/advisories/GHSA-gcfq-8gqf-4876","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gcfq-8gqf-4876","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:09.980Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-364880d3ea9ff98223817ed7b1404092"],"technology":"github.com/gofiber/fiber/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.\n\n## Vulnerable Code\n\n**File:** `middleware/proxy/proxy.go`, lines 270-285\n\n```go\nfunc BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {\n    r := &roundrobin{\n        current: 0,\n        pool:    servers,\n    }\n    return func(c fiber.Ctx) error {\n        server := r.get()\n        if !strings.HasPrefix(server, \"http\") {\n            server = \"http://\" + server\n        }\n        c.Request().Header.Add(\"X-Real-IP\", c.IP())   // line 282: Add, not Set\n        return Do(c, server+c.OriginalURL(), clients...)\n    }\n}\n```\n\n## Data Flow\n\n1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP)\n2. `BalancerForward` handler executes at line 282\n3. `c.Request().Header.Add(\"X-Real-IP\", c.IP())` APPENDS the real IP as a second header\n4.","public_affected_ranges":["<= 3.2.0"]},{"certainty":"source_listed","source_ids":["sr-364880d3ea9ff98223817ed7b1404092"],"technology":"github.com/gofiber/fiber/v2","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.\n\n## Vulnerable Code\n\n**File:** `middleware/proxy/proxy.go`, lines 270-285\n\n```go\nfunc BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler {\n    r := &roundrobin{\n        current: 0,\n        pool:    servers,\n    }\n    return func(c fiber.Ctx) error {\n        server := r.get()\n        if !strings.HasPrefix(server, \"http\") {\n            server = \"http://\" + server\n        }\n        c.Request().Header.Add(\"X-Real-IP\", c.IP())   // line 282: Add, not Set\n        return Do(c, server+c.OriginalURL(), clients...)\n    }\n}\n```\n\n## Data Flow\n\n1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP)\n2. `BalancerForward` handler executes at line 282\n3. `c.Request().Header.Add(\"X-Real-IP\", c.IP())` APPENDS the real IP as a second header\n4.","public_affected_ranges":["<= 2.52.13"]}],"null_published_at":"2026-11-03T10:03:26.557Z","source_updated_at":"2026-08-04T21:52:04.000Z","source_disclosed_at":"2026-07-02T13:50:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:58:09.980Z"}],"next_cursor":null,"snapshot_revision":"42594"}