Vulnerability Description
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gofiber | Fiber | < 3.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/gofiber/fiber/commit/04dd4e7754f61768fddccacc79057e416f13e6bfPatch
- https://github.com/gofiber/fiber/pull/4389Issue TrackingPatch
- https://github.com/gofiber/fiber/releases/tag/v3.4.0Release Notes
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2cExploitVendor Advisory
- https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2cExploitVendor Advisory
FAQ
What is CVE-2026-53624?
CVE-2026-53624 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMa...
How severe is CVE-2026-53624?
CVE-2026-53624 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53624?
Check the references section above for vendor advisories and patch information. Affected products include: Gofiber Fiber.