Go github.com/gofiber/fiber/v2

Name: Go github.com/gofiber/fiber/v2
Brand: Go

productUS

pkg:golang/github.com/gofiber/fiber/v2

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

by severity

3critical5high3medium0low

updated 2026-10-28

vulnerabilities (12)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-20744US	medium5.9	0.72% (54th)	—	2.43.0	2019-01-28	2.0.0 → 2.43.0
CVE-2024-38513US	critical9.8	0.69% (53rd)	—	2.52.5	2024-07-01	< 2.52.5
CVE-2026-25882US	high7.5	0.67% (52nd)	—	2.52.12	2026-02-24	< 2.52.12
CVE-2024-25124US	critical9.8	0.66% (51st)	—	2.52.1	2024-02-21	< 2.52.1
CVE-2023-41338US	medium5.3	0.66% (51st)	—	2.49.2-0.20230906112033-b8c9ede6efa2	2023-09-08	2 versions
CVE-2025-66630US	critical9.4	0.53% (45th)	—	2.52.11	2026-02-09	< 2.52.11
CVE-2025-48075US	high7.5	0.53% (45th)	—	2.52.7	2025-05-22	2.52.6 → 2.52.7
CVE-2026-45045US	—	0.46% (40th)	—	2.52.14	2026-07-08	< 2.52.14
CVE-2025-54801US	high7.5	0.40% (34th)	—	2.52.9	2025-08-06	< 2.52.9
CVE-2023-45128US	high8.8	0.36% (30th)	—	2.50.0	2023-10-16	< 2.50.0
CVE-2023-45141US	high8.8	0.31% (24th)	—	2.50.0	2023-10-16	< 2.50.0
CVE-2026-42554US	medium6.1	0.21% (12th)	—	2.52.13	2026-05-11	< 2.52.13

The flaw types (CWEs) most of these CVEs share.

CWE-129Improper Validation of Array Index2 CVEs
CWE-346Origin Validation Error2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-565Reliance on Cookies without Validation and Integrity Checking2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-290Authentication Bypass by Spoofing1 CVEs
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1 CVEs
CWE-384Session Fixation1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.