CVE-2026-44332

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.3.0

Description The default Authorizer function in the BasicAuth middleware, located in middleware/basicauth/config.go, uses short-circuit evaluation when validating credentials. If a username does not exist, the system skips the password hash comparison entirely. This creates a significant timing difference between requests for valid and invalid usernames—approximately 100ms versus 100ns when using bcrypt—which allows a remote attacker to reliably perform username enumeration by measuring response latency.

Recommendations Update Fiber to version 3.3.0 or later.