GO-2026-4540
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/gofiber/fiber/v3 | 0 | 3.1.0 |
Related vulnerabilities
- CVE-2026-25891 Fiber is an Express inspired web framework written in Go. Same vulnerability
- GO-2026-4534 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in… Also affects github.com/gofiber/fiber/v3
- GO-2026-4543 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in… Also affects github.com/gofiber/fiber/v3
- CVE-2026-25899 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v3
- CVE-2026-25882 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v3